Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Desktop\informe_payload.exe	N/A
N/A	N/A	C:\windows\winlogon.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\informe_payload.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\informe_payload.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\windows\\winlogon.exe\""	C:\windows\winlogon.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	\??\c:\windows\winlogon.exe	C:\Users\Admin\Desktop\informe_payload.exe	N/A
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
File created	\??\c:\windows\winlogon.exe	C:\Users\Admin\Desktop\informe_payload.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2364 wrote to memory of 2752	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 2752	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 2752	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 2752	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	C:\Windows\SysWOW64\cmd.exe
PID 548 wrote to memory of 2800	N/A	C:\Users\Admin\Desktop\informe_payload.exe	C:\windows\winlogon.exe
PID 548 wrote to memory of 2800	N/A	C:\Users\Admin\Desktop\informe_payload.exe	C:\windows\winlogon.exe
PID 548 wrote to memory of 2800	N/A	C:\Users\Admin\Desktop\informe_payload.exe	C:\windows\winlogon.exe
PID 548 wrote to memory of 2800	N/A	C:\Users\Admin\Desktop\informe_payload.exe	C:\windows\winlogon.exe

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\informe_payload.pdf" (cd "Desktop"))&(if exist "My Documents\informe_payload.pdf" (cd "My Documents"))&(if exist "Documents\informe_payload.pdf" (cd "Documents"))&(if exist "Escritorio\informe_payload.pdf" (cd "Escritorio"))&(if exist "Mis Documentos\informe_payload.pdf" (cd "Mis Documentos"))&(start informe_payload.pdf) To view the encrypted content please tick the "Do not show this message again" box and press Open.

C:\Users\Admin\Desktop\informe_payload.exe

"C:\Users\Admin\Desktop\informe_payload.exe"

C:\windows\winlogon.exe

"C:\windows\winlogon.exe"

C:\Users\Admin\Desktop\informe_payload.exe

"C:\Users\Admin\Desktop\informe_payload.exe"

C:\Users\Admin\Desktop\informe_payload.exe

"C:\Users\Admin\Desktop\informe_payload.exe"

Network

Country	Destination	Domain	Proto
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp

Files

memory/2364-0-0x0000000003420000-0x0000000003422000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	d79e62e66220063abc7fb8d0b93a94e6
SHA1	59420553c584f5e6dcc7b506310aa4cad4ab1728
SHA256	20f45dfe23213c610d28a01e948c13b01090314992ad392932402c78951c115d
SHA512	75a9dee64a08762f90d9fe068e8de5a17586b735810e26d2cbdd3955233fb42762aa3b1d81b5a2533cdbe2c5cd77d1a85c03d9323d488dd3f5533cc26f58f78e

C:\Users\Admin\Desktop\informe_payload.exe

MD5	8606faa60b008da0ce43437dc81be1e2
SHA1	13444f825362a6a946b3a91b13784d78fe3fc422
SHA256	4de3dde86d66424d79fcb561ace579d6b22919f52505aa177bd161bcf4157c4f
SHA512	e23e310399baf03034b51f1be445ea01a6ef2ec4f82da43af6c4639dc28834d49119ddb83f40019ff6c9b45124da637d579ef5289620a13a7078284c7fead33b

memory/548-74-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2800-76-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2800-78-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1580-80-0x0000000000400000-0x000000000040D000-memory.dmp

memory/2940-84-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win10-20240404-en

Max time kernel

140s

Max time network

140s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8633F27BEC170C893281B155BC191E4B --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0746B4054FC1EE71D23C5E14D4FB9DF6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0746B4054FC1EE71D23C5E14D4FB9DF6 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DE9E633A2C0B03BC60310CFCF1A8723C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DE9E633A2C0B03BC60310CFCF1A8723C --renderer-client-id=4 --mojo-platform-channel-handle=2212 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C65EB6BE26C6B8C323BAC885BA21A2F --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF1F2A3EDC6DB82CF4AD01332E555873 --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CEED246F524BDFFB3BB3CEB6B7AC2D98 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	151.16.21.2.in-addr.arpa	udp
US	8.8.8.8:53	24.251.17.2.in-addr.arpa	udp
US	52.111.227.14:443		tcp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	200.64.52.20.in-addr.arpa	udp

Files

memory/1580-30-0x000000000C000000-0x000000000C021000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	b30d3becc8731792523d599d949e63f5
SHA1	19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256	b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512	523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	752a1f26b18748311b691c7d8fc20633
SHA1	c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256	111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512	a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	8712f6d288acae5384f78d1d1f78f4f6
SHA1	c29dbc4eee05930dd8d4dfddc8308bee5fddd5b1
SHA256	1e33507d6e8025c862356b537530203e417ca3f0b625f85a3531427f763d81b9
SHA512	8411dc51bc57c8fe249058f57d5b2c8e8df77cf8d4d346cf1a83bae47a88811b09593449fe4efb8a73d183bb77adf0b0eef4395de312faaa742da8751a5dc93d

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1DC0A448F5A0DAA66AE43DBAE3214671 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CE2424874B8814F8F29EA7D503AE47CC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CE2424874B8814F8F29EA7D503AE47CC --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=883DC467F2E9B198FA97F1875AE97865 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DC4887F5B3DE54FBAAFA639E65CE3D42 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DC4887F5B3DE54FBAAFA639E65CE3D42 --renderer-client-id=5 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7351096A9C66D2C3E5777A08368E6946 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=70995F993735EA6B3676A1097DA3D47C --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	151.16.21.2.in-addr.arpa	udp
US	8.8.8.8:53	49.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	25.140.123.92.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	16.173.189.20.in-addr.arpa	udp

Files

memory/896-32-0x000000000CC60000-0x000000000CC81000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	395810878a4e4b6f2d14306f152465f4
SHA1	581aa224e1f6f15eb4f44d31dacbb62431e02bb7
SHA256	b0247b263eefdae9cb3838a30958fb534db0ded61f52e680bf6fef62f0a073f9
SHA512	e21b900646ef4262f3cf524d58c0385f84430a38db144f61774084ca90188713db65e0fe30a405c50420662943c1453883171e2213826a1dc27fb6cdb7c97b9d

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	e512dd735d53df0ba2b1f5717731c2af
SHA1	4fa2175fa1d9b72ba1c110ae5e9f340585b70d46
SHA256	5e8f12ecb854065fe119943d3ea7de8ca8bedb85ccf1ccc4f673219536fdda8f
SHA512	07d625d24badadf44d92dc5eee160ed89b2e6cf13789cf244a3a17b1388824733f327ab6f2f2c48ec31353b8ad8bf251655b073a7443f08964a1f3dd378269b4

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win7-20240508-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\windows\winlogon.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\windows\\winlogon.exe\""	C:\windows\winlogon.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A
File opened for modification	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1988 wrote to memory of 1336	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 1988 wrote to memory of 1336	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 1988 wrote to memory of 1336	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 1988 wrote to memory of 1336	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe

Processes

C:\Users\Admin\AppData\Local\Temp\informe_payload.exe

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

C:\windows\winlogon.exe

"C:\windows\winlogon.exe"

Network

Country	Destination	Domain	Proto
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp

Files

C:\Windows\winlogon.exe

MD5	8606faa60b008da0ce43437dc81be1e2
SHA1	13444f825362a6a946b3a91b13784d78fe3fc422
SHA256	4de3dde86d66424d79fcb561ace579d6b22919f52505aa177bd161bcf4157c4f
SHA512	e23e310399baf03034b51f1be445ea01a6ef2ec4f82da43af6c4639dc28834d49119ddb83f40019ff6c9b45124da637d579ef5289620a13a7078284c7fead33b

memory/1988-7-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1336-8-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1336-10-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win11-20240419-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\windows\winlogon.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\windows\\winlogon.exe\""	C:\windows\winlogon.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A
File created	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3124 wrote to memory of 4172	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 3124 wrote to memory of 4172	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 3124 wrote to memory of 4172	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe

Processes

C:\Users\Admin\AppData\Local\Temp\informe_payload.exe

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

C:\windows\winlogon.exe

"C:\windows\winlogon.exe"

Network

Country	Destination	Domain	Proto
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp

Files

C:\Windows\winlogon.exe

MD5	8606faa60b008da0ce43437dc81be1e2
SHA1	13444f825362a6a946b3a91b13784d78fe3fc422
SHA256	4de3dde86d66424d79fcb561ace579d6b22919f52505aa177bd161bcf4157c4f
SHA512	e23e310399baf03034b51f1be445ea01a6ef2ec4f82da43af6c4639dc28834d49119ddb83f40019ff6c9b45124da637d579ef5289620a13a7078284c7fead33b

memory/3124-7-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4172-9-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4172-11-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win11-20240508-en

Max time kernel

141s

Max time network

138s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\Registry\User\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\NotificationData	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\analisis.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9B445B5FC0E078AE94DE8AC405D191E4 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7AF7B8D34E2A37931DC23B1F74E7E5D4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7AF7B8D34E2A37931DC23B1F74E7E5D4 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8C9A89726693295503EC8CDCA7E89E4 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B6AD0D46D1B0161FD6D9FAE24768BB85 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BE9826A444160B47AA4DD0B7D08D9D89 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BE9826A444160B47AA4DD0B7D08D9D89 --renderer-client-id=6 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9FFE578200E3B4A9E297F5C4C2262D0A --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	52.111.229.43:443		tcp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	b30d3becc8731792523d599d949e63f5
SHA1	19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256	b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512	523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	752a1f26b18748311b691c7d8fc20633
SHA1	c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256	111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512	a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	1bb8ee7e56dd08177609400ef08318c1
SHA1	440b7ef638a3c6497b0413506095e7b08b0c0750
SHA256	4597bb7d5fb61e1c34813fd283e7c3ab5013898afaeea6b4ee9cda0f56a826fe
SHA512	bab3878aa43e81f69fc18b7398b2b3228c46370cc1576d7e761b748dcad858f88a0e780c12cd0b7d4d78af7b88c4defc9ccb66be876af1f2afc23f66b174d159

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5	f7df721cc5ef2df459d4a52da85a2ed0
SHA1	cfd54a6cbe000828e4c6d168bfd3a0ddcbebb781
SHA256	06cf3c76ba4712889bf84c70b05a4e8d5b2191445ea696cb8b2629d3edee0f59
SHA512	5368674b37668f7dca0e55b19869df69f14a681e595bcb1c2f65314ba10eb9db01109e98a1ae6c4c5ecf2f8b27d451279056c0170b5654e952e85d8d3a3f4d36

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win10-20240404-en

Max time kernel

143s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\windows\winlogon.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\windows\\winlogon.exe\""	C:\windows\winlogon.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A
File opened for modification	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3508 wrote to memory of 3252	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 3508 wrote to memory of 3252	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 3508 wrote to memory of 3252	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe

Processes

C:\Users\Admin\AppData\Local\Temp\informe_payload.exe

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

C:\windows\winlogon.exe

"C:\windows\winlogon.exe"

Network

Country	Destination	Domain	Proto
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
CO	190.85.249.45:443		tcp
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	27.73.42.20.in-addr.arpa	udp

Files

C:\Windows\winlogon.exe

MD5	8606faa60b008da0ce43437dc81be1e2
SHA1	13444f825362a6a946b3a91b13784d78fe3fc422
SHA256	4de3dde86d66424d79fcb561ace579d6b22919f52505aa177bd161bcf4157c4f
SHA512	e23e310399baf03034b51f1be445ea01a6ef2ec4f82da43af6c4639dc28834d49119ddb83f40019ff6c9b45124da637d579ef5289620a13a7078284c7fead33b

memory/3508-5-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3252-6-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3252-8-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-21 14:24

Reported

2024-05-21 14:27

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\windows\winlogon.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"C:\\windows\\winlogon.exe\""	C:\windows\winlogon.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A
File opened for modification	\??\c:\windows\winlogon.exe	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2812 wrote to memory of 1672	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 2812 wrote to memory of 1672	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe
PID 2812 wrote to memory of 1672	N/A	C:\Users\Admin\AppData\Local\Temp\informe_payload.exe	C:\windows\winlogon.exe

Processes

C:\Users\Admin\AppData\Local\Temp\informe_payload.exe

"C:\Users\Admin\AppData\Local\Temp\informe_payload.exe"

C:\windows\winlogon.exe

"C:\windows\winlogon.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
NL	23.62.61.57:443	www.bing.com	tcp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	57.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	25.140.123.92.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
CO	190.85.249.45:443		tcp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
CO	190.85.249.45:443		tcp

Files

C:\Windows\winlogon.exe

MD5	8606faa60b008da0ce43437dc81be1e2
SHA1	13444f825362a6a946b3a91b13784d78fe3fc422
SHA256	4de3dde86d66424d79fcb561ace579d6b22919f52505aa177bd161bcf4157c4f
SHA512	e23e310399baf03034b51f1be445ea01a6ef2ec4f82da43af6c4639dc28834d49119ddb83f40019ff6c9b45124da637d579ef5289620a13a7078284c7fead33b

memory/2812-8-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1672-9-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1672-11-0x0000000000400000-0x000000000040D000-memory.dmp

Sample ID	240521-rq5vkaha43
Target	analisis.pdf
SHA256	cc48d8c645c27dd850652c0a66e22dd2e1b62bbf6ad208f94b8f5847684a8d17
Tags	persistence pdf link javascript

Malware Analysis Report

2024-07-28 06:34

Table of Contents

Analysis Overview

Threat Level: Shows suspicious behavior

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files