Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe
Resource
win10v2004-20240226-en
General
-
Target
c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe
-
Size
312KB
-
MD5
05a3bd7ef592db699623fecc1c70fb4b
-
SHA1
b52d82b03817fc3b8d8f502c9015dcf97fa73d74
-
SHA256
c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb
-
SHA512
9e5b2eec1868c7cec92168c8cd6c046712ee03ba0a575cffcab1f225387eacf0843ef6d89074f5cc8aaafd8e67a4c845b0d3cd2de7a92018efe84a6e6ef4fafa
-
SSDEEP
6144:caQbbFhjLoqmVtrKA2S7uacrEPy08xnLVYqQFFhwUZXEvxfD42c95HuyhR:cTxcfNzPyR4TOsd3
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 5 IoCs
pid Process 1968 acrotray.exe 4000 acrotray.exe 3656 acrotray .exe 1572 acrotray .exe 3200 msedge.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe" c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\program files (x86)\microsoft\edge\application\msedge.exe c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe File created C:\Program Files (x86)\Adobe\acrotray .exe c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe File created C:\Program Files (x86)\Adobe\acrotray.exe c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2002751290" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c2af2ebd35eee478c7378be8210a2af00000000020000000000106600000001000020000000b589b318c0e8844c519615c3137ea801ffdcd6666e06620428500141ea258593000000000e8000000002000020000000bd68c6b47699b056260f983dcb40038dd739da0d790334a913eb8a3029f2102220000000f8d23cfd25a11faa3d3f3830f9c582628815f9f5adc419a79f76f438119cad29400000000ce51a9e0e464ff9abd300a88a6f5547ef2a885db13d3dc1b57e367501c1af52c98213dd28d5f58406c4fc0015db364667cefb3712a6665fb2ac34e24c490b27 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31110293" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c2af2ebd35eee478c7378be8210a2af000000000200000000001066000000010000200000000502b16bbf43ae454c8fcbb17fc9ff21992d2696e9fae6b5d789f0c08f09632f000000000e8000000002000020000000cf648051e73d2ed22b7158a82945b61157b330dd5530a5933802c1474d7db190200000005460b3a8417e7ac334c0b907b5e7164624f04c9b26647866fd97310483ce166c40000000a856bc29162191c0346b5c618f62a0cccca7ce6b75ef27b32c963b82c9a2b79ea0bc244a636024852f4471c9124da371924c376ff4e8fa94748b377670202158 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31110293" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1084297695b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c2af2ebd35eee478c7378be8210a2af00000000020000000000106600000001000020000000ffb22761e5f00ed229b0e2a5a4d139e5bccc17e4f774291300888f90a7286cc1000000000e800000000200002000000091d4f95602237c6a7bc1b6374cdab4d961f2b7634913ebbcfa2fd717c9658184200000009a6d3346d5c38f7b27d2f08393ecb4e7eca6819fcf5d726a61b296cccbd9f7e5400000000c280f6339430bc49c1396534d9a71f1d4865e267c29d7335df06ce799042bc4d84784771af59d5fe4781a32942f1f602d46f67af8f559e573b9b416dde3445e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c2af2ebd35eee478c7378be8210a2af00000000020000000000106600000001000020000000de88accdf6c87f849689df3b0c4443056bf1597a0c60415e5968a48a17d0d6ad000000000e800000000200002000000008e2ab3af6d6240c7b18fddda3f5b005d1ec3dab1077d89eb7992c3b8b34c5e62000000080441223aef05c405f0d6303fadaf9899de768e88a9702f8e184fc2157d69b85400000004395e45aa35f233675d77a9ad19d4281b1969d5803420de34b2c9bd1511f184453693d84be2505125b636630d3ddadd80d66381827f8783ed97a6c792b57e248 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4044fc8595b4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a8af6895b4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b4516995b4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2002596419" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A25B0E96-2088-11EF-B9F7-5A176B010E55} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 1968 acrotray.exe 1968 acrotray.exe 1968 acrotray.exe 1968 acrotray.exe 1968 acrotray.exe 1968 acrotray.exe 4000 acrotray.exe 4000 acrotray.exe 4000 acrotray.exe 4000 acrotray.exe 3656 acrotray .exe 3656 acrotray .exe 3656 acrotray .exe 3656 acrotray .exe 3656 acrotray .exe 3656 acrotray .exe 1572 acrotray .exe 1572 acrotray .exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe 1572 acrotray .exe 1572 acrotray .exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 4000 acrotray.exe 4000 acrotray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe Token: SeDebugPrivilege 2192 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe Token: SeDebugPrivilege 1968 acrotray.exe Token: SeDebugPrivilege 4000 acrotray.exe Token: SeDebugPrivilege 3656 acrotray .exe Token: SeDebugPrivilege 1572 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1388 iexplore.exe 1388 iexplore.exe 1388 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1388 iexplore.exe 1388 iexplore.exe 5052 IEXPLORE.EXE 5052 IEXPLORE.EXE 1388 iexplore.exe 1388 iexplore.exe 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE 1388 iexplore.exe 1388 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3964 wrote to memory of 2192 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 91 PID 3964 wrote to memory of 2192 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 91 PID 3964 wrote to memory of 2192 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 91 PID 3964 wrote to memory of 1968 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 99 PID 3964 wrote to memory of 1968 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 99 PID 3964 wrote to memory of 1968 3964 c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe 99 PID 1968 wrote to memory of 4000 1968 acrotray.exe 102 PID 1968 wrote to memory of 4000 1968 acrotray.exe 102 PID 1968 wrote to memory of 4000 1968 acrotray.exe 102 PID 1968 wrote to memory of 3656 1968 acrotray.exe 103 PID 1968 wrote to memory of 3656 1968 acrotray.exe 103 PID 1968 wrote to memory of 3656 1968 acrotray.exe 103 PID 3656 wrote to memory of 1572 3656 acrotray .exe 104 PID 3656 wrote to memory of 1572 3656 acrotray .exe 104 PID 3656 wrote to memory of 1572 3656 acrotray .exe 104 PID 1388 wrote to memory of 5052 1388 iexplore.exe 105 PID 1388 wrote to memory of 5052 1388 iexplore.exe 105 PID 1388 wrote to memory of 5052 1388 iexplore.exe 105 PID 1388 wrote to memory of 2596 1388 iexplore.exe 108 PID 1388 wrote to memory of 2596 1388 iexplore.exe 108 PID 1388 wrote to memory of 2596 1388 iexplore.exe 108 PID 1388 wrote to memory of 1652 1388 iexplore.exe 109 PID 1388 wrote to memory of 1652 1388 iexplore.exe 109 PID 1388 wrote to memory of 1652 1388 iexplore.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe" C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\c67e0ddd9c5ba98b8de666e14b37c95fb60ca0a8b9027c865c6faec2fbd42ffb.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:1680
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5052
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:17412 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
- Executes dropped EXE
PID:3200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317KB
MD5056255bba4877aedb58c7cc97ab8007e
SHA1521699034f29c25816951f5e3c1a716c58c23375
SHA256a07d8b88e3b03abcc2fbff4b25cd19e17a90b6c36df562044910919f214be894
SHA512b15141828061ae003364ca11203f370a7cda866a7c800dccb3f0b28151ef1a5e567df202526635941e8465a88fcac71f0dfc8b371fc0f98c02bc5ab1b23cb41d
-
Filesize
317KB
MD53ad2fc54cafef085a91d324b0bdb6541
SHA18ff3f62b34a15aabb80f320046b8980a699f6f00
SHA256111c470e81f462e9afaa7e0f9281e4b7e801dc36144ba92c84b0eae3a150159b
SHA512ae637a3cf464fd533886c4ce9cc55957985869215edca50fa5ae993c40436c83616c21cccb4dec48d44c1f2f263221ed79f1edfb66bdd8dcb99a8e989ce1c29d
-
Filesize
346KB
MD5f3c3d2997589d8bb187dd6f48e41e03c
SHA1811501d88b763a8f0348c4c54bbf58e5067db342
SHA256f7e3b8b73f0139785e7331c887c0853e3628f48d87b7febea2d1c4dd52a6089b
SHA512bcbffbbcd65ddedd77d67a3fd0dd5a9aaae6e98849b54f0adf11006a23320c98282551533df220664537652324d38d7eac33a0e31dc166f5a24d133a0514f543