rhadamanthys | b7615563fc08671d442b6f8102eeb61f5058f75821bac5f701385f7c123d7fa5

Analysis

max time kernel
220s
max time network
451s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
04-06-2024 04:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Requirements upwork.scr
Size

699.6MB
MD5

1cbf33e0f9964d14cc107236d8060972
SHA1

bd7052b3f20a83ed7ce837030d7aee6b1150781a
SHA256

b7615563fc08671d442b6f8102eeb61f5058f75821bac5f701385f7c123d7fa5
SHA512

1042f8ee6b23000d55082af3061a8559c266302d5a72eb35041d33a090ec4e70850f7d55df3c3463478d40d0a17f4a1834d9e72a59829041540898d6b4bba63b
SSDEEP

393216:fM07b4unYmNXdJu4LTYi7dRcogr6+7QJhrrXZEwCz:fNIunb9bJRRgrWXZEw0

Score

10^/10

rhadamanthys stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

calc.exe

description pid process target process

PID 5024 created 2500 5024 calc.exe sihost.exe
Executes dropped EXE 3 IoCs

Processes:

pythonw.exepythonw.execalc.exe

pid process

4828 pythonw.exe
2912 pythonw.exe
5024 calc.exe
Loads dropped DLL 4 IoCs

Processes:

pythonw.exepythonw.exe

pid process

4828 pythonw.exe
4828 pythonw.exe
2912 pythonw.exe
2912 pythonw.exe

description	pid	process	target process
PID 5024 created 2500	5024	calc.exe	sihost.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
File opened (read-only)	\??\W:	explorer.exe
File opened (read-only)	\??\X:	explorer.exe
File opened (read-only)	\??\y:	explorer.exe
File opened (read-only)	\??\G:	explorer.exe
File opened (read-only)	\??\I:	explorer.exe
File opened (read-only)	\??\l:	explorer.exe
File opened (read-only)	\??\r:	explorer.exe
File opened (read-only)	\??\q:	explorer.exe
File opened (read-only)	\??\V:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\h:	explorer.exe
File opened (read-only)	\??\j:	explorer.exe
File opened (read-only)	\??\J:	explorer.exe
File opened (read-only)	\??\t:	explorer.exe
File opened (read-only)	\??\K:	explorer.exe
File opened (read-only)	\??\o:	explorer.exe
File opened (read-only)	\??\Q:	explorer.exe
File opened (read-only)	\??\R:	explorer.exe
File opened (read-only)	\??\u:	explorer.exe
File opened (read-only)	\??\w:	explorer.exe
File opened (read-only)	\??\z:	explorer.exe
File opened (read-only)	\??\L:	explorer.exe
File opened (read-only)	\??\m:	explorer.exe
File opened (read-only)	\??\n:	explorer.exe
File opened (read-only)	\??\p:	explorer.exe
File opened (read-only)	\??\v:	explorer.exe
File opened (read-only)	\??\A:	explorer.exe
File opened (read-only)	\??\B:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\T:	explorer.exe
File opened (read-only)	\??\x:	explorer.exe
File opened (read-only)	\??\Y:	explorer.exe
File opened (read-only)	\??\b:	explorer.exe
File opened (read-only)	\??\e:	explorer.exe
File opened (read-only)	\??\H:	explorer.exe
File opened (read-only)	\??\N:	explorer.exe
File opened (read-only)	\??\S:	explorer.exe
File opened (read-only)	\??\a:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\k:	explorer.exe
File opened (read-only)	\??\O:	explorer.exe
File opened (read-only)	\??\s:	explorer.exe
File opened (read-only)	\??\U:	explorer.exe
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\g:	explorer.exe
File opened (read-only)	\??\i:	explorer.exe
File opened (read-only)	\??\M:	explorer.exe
File opened (read-only)	\??\P:	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

pythonw.exeexplorer.exe

description	pid	process	target process
PID 2912 set thread context of 4280	2912	pythonw.exe	cmd.exe
PID 4592 set thread context of 5024	4592	explorer.exe	calc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exeWINWORD.EXEfirefox.exePOWERPNT.EXEfirefox.exeWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEWINWORD.EXEPOWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeAcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2538657636"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31110811"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "118"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 2 IoCs

Processes:

Requirements upwork.scrfirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	Requirements upwork.scr
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

Processes:

POWERPNT.EXEWINWORD.EXEWINWORD.EXE

pid process

2800 POWERPNT.EXE
4052 WINWORD.EXE
4052 WINWORD.EXE
1988 WINWORD.EXE
1988 WINWORD.EXE

pid	process
2800	POWERPNT.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

pythonw.exepythonw.execmd.exeAcroRd32.exeexplorer.execalc.exedialer.exe

pid	process
4828	pythonw.exe
2912	pythonw.exe
2912	pythonw.exe
4280	cmd.exe
4280	cmd.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
4592	explorer.exe
4592	explorer.exe
5024	calc.exe
5024	calc.exe
944	dialer.exe
944	dialer.exe
944	dialer.exe
944	dialer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

pythonw.execmd.exe

pid process

2912 pythonw.exe
4280 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 1388 firefox.exe
Token: SeDebugPrivilege 1388 firefox.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

AcroRd32.exefirefox.exe

pid process

3140 AcroRd32.exe
1388 firefox.exe
1388 firefox.exe
1388 firefox.exe
1388 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1388 firefox.exe
1388 firefox.exe
1388 firefox.exe

pid	process
2912	pythonw.exe
4280	cmd.exe

description	pid	process
Token: SeDebugPrivilege	1388	firefox.exe
Token: SeDebugPrivilege	1388	firefox.exe

pid	process
1388	firefox.exe
1388	firefox.exe
1388	firefox.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

AcroRd32.exePOWERPNT.EXEWINWORD.EXEfirefox.exeWINWORD.EXELogonUI.exe

pid	process
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
2800	POWERPNT.EXE
2800	POWERPNT.EXE
2800	POWERPNT.EXE
2800	POWERPNT.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
4052	WINWORD.EXE
1388	firefox.exe
1988	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE
1988	WINWORD.EXE
860	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Requirements upwork.scrpythonw.exepythonw.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3728 wrote to memory of 4828	3728	Requirements upwork.scr	pythonw.exe
PID 3728 wrote to memory of 4828	3728	Requirements upwork.scr	pythonw.exe
PID 3728 wrote to memory of 3140	3728	Requirements upwork.scr	AcroRd32.exe
PID 3728 wrote to memory of 3140	3728	Requirements upwork.scr	AcroRd32.exe
PID 3728 wrote to memory of 3140	3728	Requirements upwork.scr	AcroRd32.exe
PID 4828 wrote to memory of 2912	4828	pythonw.exe	pythonw.exe
PID 4828 wrote to memory of 2912	4828	pythonw.exe	pythonw.exe
PID 2912 wrote to memory of 4280	2912	pythonw.exe	cmd.exe
PID 2912 wrote to memory of 4280	2912	pythonw.exe	cmd.exe
PID 2912 wrote to memory of 4280	2912	pythonw.exe	cmd.exe
PID 3140 wrote to memory of 4388	3140	AcroRd32.exe	RdrCEF.exe
PID 3140 wrote to memory of 4388	3140	AcroRd32.exe	RdrCEF.exe
PID 3140 wrote to memory of 4388	3140	AcroRd32.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 3232	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe
PID 4388 wrote to memory of 1908	4388	RdrCEF.exe	RdrCEF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2500

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:944

C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr
"C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr" /S
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe
"C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe" /S
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe
"C:\Users\Admin\AppData\Roaming\wh_Ultra\pythonw.exe" /S
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4280

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" /S
5⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4592

C:\Windows\SysWoW64\calc.exe
C:\Windows\SysWoW64\calc.exe
6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:4388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CE277EAE1678AB6E8B476BAB71AE7B15 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3232

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E90432509E9D38F476805D716D21FA24 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E90432509E9D38F476805D716D21FA24 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1908

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=26ABFC761EC71ADAE47311497066F5A8 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:860

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=14827C03E35EA531F01C246B5A499A2E --mojo-platform-channel-handle=2480 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9269D32646CE227D00B350FD5D7F7402 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9269D32646CE227D00B350FD5D7F7402 --renderer-client-id=6 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:1
4⤵
PID:5084

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B0D071140FE9555B85A59363A73CDC1F --mojo-platform-channel-handle=2700 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\PublishGrant.pot"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:4892

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\PopInstall.odt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.0.1882831542\1656243407" -parentBuildID 20230214051806 -prefsHandle 1728 -prefMapHandle 1724 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d964d13-d483-4f9e-942a-65b3c483a78c} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 1860 25622d0cb58 gpu
3⤵
PID:1548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.1.647214920\489028315" -parentBuildID 20230214051806 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a95e997b-8cd1-4005-bdc5-209541cdc398} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 2384 25615f88d58 socket
3⤵
- Checks processor information in registry
PID:1528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.2.1797533861\776183052" -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2740 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b27b5b63-212d-4626-b085-db1978320ce8} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 2756 25625b19558 tab
3⤵
PID:3820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.3.2056611482\222565218" -childID 2 -isForBrowser -prefsHandle 3716 -prefMapHandle 3708 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b959aa4-b547-4070-afbf-5f033a758f42} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 3792 2562872b558 tab
3⤵
PID:4708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.4.631345537\352379539" -childID 3 -isForBrowser -prefsHandle 5192 -prefMapHandle 5184 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c188e739-eb6a-47e2-9aa8-558d6b3e28e2} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 5204 2562b168b58 tab
3⤵
PID:3976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.5.128250515\2112905415" -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5416 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c69bc43-59d9-4309-a2fd-6401037e5b40} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 5428 2562b169d58 tab
3⤵
PID:1860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1388.6.1322174331\695435263" -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1336 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cca90325-f6f2-4c48-93b3-f782df89082d} 1388 "\\.\pipe\gecko-crash-server-pipe.1388" 5520 2562b16be58 tab
3⤵
PID:3932

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
126f2c395badc1b07f3d24b1fee26783

SHA1
20bfe97b06947803cee57888fd9d87c2e9fad057

SHA256
de6db7101d2566e857d5306c081026d407f8a4909201e9543968338507907cd7

SHA512
1fed038e003fe3454578a4a1565fb403722d414a77efc5cd8697f85d8e4dd9b9200c4243b1902315c8c61286655dae96592995e373018d06601f9207f0ebc7a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
471B

MD5
8724ce8bec4b98b48ce4061ca8e9799b

SHA1
3802632acf4817809db62516c8a03584d983ca54

SHA256
4a37f017c8d38e88d6b0c25decf9fc65168e34b689608134c5171e285355507e

SHA512
2e3f6b45707d19ed68bf8cb83cf4188e7a8a014e4960786e6fff1f14cfb413853da635b00b358857aa242934671a8ffd5b4f6799025ee810cef5f3191e214cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
07f9521e7aea5afa77da5a8bcd66582e

SHA1
c554fce31c11389924d1564f2e45920da03cf4d8

SHA256
1d15f66cc8964ea8c81d35de46bb29bf2b3dea0a533b3fb81c37c240d87fa6c6

SHA512
a659cb4347205a027645e98c449f25761b925c58eec5665e56f65fba25cecddad844b223e1c22fc6e4212b585ec811c4f80f60815e8e381f789b7bfd37f7e6e6

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
611199810c3c7de7fd1ed2a9a403e3dd

SHA1
41997338e81ce1e23a1871931f31de64a80b5803

SHA256
63601c99fde32ee46733a427e02ac798072f66b5a77c0b7b35fb994b42901a6c

SHA512
de0d2ab228a2ad1a13f7153ce6050d2ad8d927ec72f7a3fec92af5b16fa3b9786be968316c61229f26cdb9b557e868e358f7e7cc848a94b2bcc5b6c6d091b63f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A523A364-DD78-4FA5-A35F-30CECCFDC48E

Filesize
161KB

MD5
f18cf64e80df54881a893cdaca8bde4d

SHA1
7ecd1d60696ca53e5dfbf0a5f6ed3290a7829e48

SHA256
c5db86c889ef6608853f2147ee347930ae773482bc0e3fd10ffeb78ae3559f48

SHA512
c789ff0fd6272122033ebb34a7dad66770a609a98ce11128a0497d3291e3c6d261caffb3b054cf72f96644cf75ea5578de0d413303dd755c28fc6653007fdab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
b00f3f56c104c94e03cd2ad8452c14e7

SHA1
51b78e45015e0d9d62fbdf31b75a22535a107204

SHA256
ba2b669020334ff01a85bfc900ea4371ea557bd315f154875d9bdfdc16ae8b50

SHA512
93e1609be5bbb414c285f37432ce93294c3d1583ef46c7c6c570c122f0b166c34b0ad87de708005c8af97dee27923ba53395a34c2563cdadf3c0a708848b3525

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6t7awfwd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
e848030605a550a85b38671932a82138

SHA1
845a1261c811582b9d414fcb18ce7fe494c5aaa4

SHA256
e549d0db35d379309a6b3fbf4b922704dc1cbaaed805aa8807eac3b03bd56818

SHA512
4488da3c69b57e403bab6f2529d1ad4b9031a0eaf7fba1f38f49d70db7d00c2ceba7ea98d0ec2d86e15e3c6a1ffb23a001cba58a2ffedb91a3148384b8c7a12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b58579d

Filesize
2.4MB

MD5
695f14cd54e65a93d5bf4264ff29a3e4

SHA1
8a870b45e1794ca1e79dd093f3e6e05a9951c7b9

SHA256
025a80732263d70541c3957eecfbd66232c0649039508ac9ad0fd59f44f9e9e5

SHA512
b46e387b30a378e8cd563fb6ae965a790257b923ccd15cf41f0ad43118104f2014893158d83335a1c3f507f818370e60fc79933fd04e9051606317ce259b3e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\THC651F.tmp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
add56ec49f8f478e84a934606effef1c

SHA1
1262ae87ef755e40752740df90d21352d5fc81ec

SHA256
22e509cf2b7202fc6b04c3d9a1b137477f11471d58a48c1f9514f89450217327

SHA512
c095f193d221696f3b087c3f224a559ad0efe4852a5392c8a3ab03f80183beec2a8327892aa481c85f1bf8165b76a029555f250e0dd5f396c823feacff4c06f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6t7awfwd.default-release\prefs-1.js

Filesize
6KB

MD5
7edfc2a9e0fbdcb531d20cddd66c4809

SHA1
072c2de00afbe7f3d511ca4c9a04b177a9d10c9b

SHA256
1235fa611a9f22923089139da27058549fe8e2a8c10c371140ef94f08cd417c1

SHA512
9e99a906a8066e3c832b964b8da150a08b8625cc4cc543c515dfc3245ab38288f25568cce011d1e30a128af531904e05d12f0c5f09e014955af682c43a28a8fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6t7awfwd.default-release\prefs.js

Filesize
6KB

MD5
9c64bd2551a296921eda3b8c5368a961

SHA1
c966023212ab2f4ed8a30697e46771dc60ef5d19

SHA256
260292f491ba309a3e96a075f8d5d124466fc42f4f6ef1aae1081f1a4cb564cb

SHA512
6e64c892928119275f07c1b2c3674414a08d0d0bb7b9a51f7925b9ae6754f370c063388f4a2add96acc855d410d34e9448a67aad4b8b7a324b259298d3333c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6t7awfwd.default-release\prefs.js

Filesize
6KB

MD5
c85428a26417c35a82d71a62e6288c39

SHA1
cefa3335909bdbbb42977ced93643d4407e5326b

SHA256
8fe8accca1589cae55c66d3cd936f8683e955e252a2d2cd60c2ab3e6e3423fa2

SHA512
7c581988909da59532f8df7d3452158a17ac38a84ed78a09ba9d92fe7b8b5165b88d4b4198c922bcdfaa1ae4b33e19452f1f3a0ffe1d344cc634d370cbdbce20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6t7awfwd.default-release\sessionstore.jsonlz4

Filesize
903B

MD5
d91aa80e5f0f1dc5399e9fd8497b4580

SHA1
87dab89561acc87d4c3613cb75989a0ddd5d233d

SHA256
413f69bcb9307bf4edca09908d392622afb20d8a291734464e84d03b3f4a8f62

SHA512
6e2c66a6e31afe8888698b0756129acaf7f64ece3e5624ac38a9613be11843124ba23beec0d72146f042cd0ee9285c21a33336967ede353d0609416845befbcc

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\birdseed.ppt

Filesize
49KB

MD5
cdec9e890deef870a230ac61480ba210

SHA1
549a622bb93e5ab4114f10d8ed884d15be5e3777

SHA256
c36e7e60ca938247cb90be8af70a8044e965dd58c69260748f6bfe3e5109eb04

SHA512
ecb49dcaeaaf7fdefb622c8a2d7b8c187e8d791f8e26e16c669600aa24868d93cbccec0e7fc1cf0be12c7ea7b4f4412f0802e93ac5f2849229aa9c0b3e6bc98e

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\python310.dll

Filesize
4.3MB

MD5
8fbbe41173ae011a717c706f25d06121

SHA1
db35f1d1a0916cc0732b9747bd67a37e827440aa

SHA256
ccd635f18a955d0d6bec012be96de876bb2009ff522c3457df40792405637a5a

SHA512
8a17ecd7545ccee3bba62df2c5a00b839f60e0009fa55d9c9d8cc962349a501c618d65f83de2a977bda9b4368224f6ea89a881478d58fa4b68a9891b998d985a

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe

Filesize
94KB

MD5
9a4cc0d8e7007f7ef20ca585324e0739

SHA1
f3e5a2e477cac4bab85940a2158eed78f2d74441

SHA256
040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92

SHA512
54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\rhatany.docx

Filesize
2.2MB

MD5
95a2d2cbff9d49bb8f71a968e6d70692

SHA1
d1880df094228be3764a6d466396cd86a16749db

SHA256
3074fd2d1c68a0224d9a1bb28c222ca303af7efe6a251b0ca2b7160c635ecdd5

SHA512
09296b402aeeec2ba5e8005753533a78cf368b361b115e0d11d79375653036c0670918564bc53119a41e5d43a8680e69d339e44d34d33b53176e54550641e098

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf

Filesize
717KB

MD5
720b78ca59dbb0e1b885f47b9c4eebd3

SHA1
98629bc8c27329023931d158d2ab879e8136b5ff

SHA256
73300eda96e39870895468cf7a7b90616b37d5d7673671c89db1776c192ed2be

SHA512
ee22206441b41881acbae939dba2f4269e652782ba485963f81d3ae2aedd3838bba2a673de502a367cdc5f1a8c33a08e120495a473d617f2ec049fa5f0be17ac

Download Submit
memory/944-222-0x00000000008D0000-0x00000000008D9000-memory.dmp

Filesize
36KB

Download
memory/944-225-0x00000000026F0000-0x0000000002AF0000-memory.dmp

Filesize
4.0MB

Download
memory/944-229-0x00000000765E0000-0x0000000076832000-memory.dmp

Filesize
2.3MB

Download
memory/944-227-0x00007FFF45340000-0x00007FFF45549000-memory.dmp

Filesize
2.0MB

Download
memory/2800-240-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-239-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-241-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-242-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-243-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-244-0x00007FFF03020000-0x00007FFF03030000-memory.dmp

Filesize
64KB

Download
memory/2800-245-0x00007FFF03020000-0x00007FFF03030000-memory.dmp

Filesize
64KB

Download
memory/2800-264-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-265-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-267-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2800-266-0x00007FFF053D0000-0x00007FFF053E0000-memory.dmp

Filesize
64KB

Download
memory/2912-73-0x00007FFF24680000-0x00007FFF247FA000-memory.dmp

Filesize
1.5MB

Download
memory/2912-46-0x00007FFF24680000-0x00007FFF247FA000-memory.dmp

Filesize
1.5MB

Download
memory/4052-275-0x00007FFF03020000-0x00007FFF03030000-memory.dmp

Filesize
64KB

Download
memory/4052-277-0x00007FFF03020000-0x00007FFF03030000-memory.dmp

Filesize
64KB

Download
memory/4280-210-0x000000006AC10000-0x000000006AD8D000-memory.dmp

Filesize
1.5MB

Download
memory/4280-79-0x00007FFF45340000-0x00007FFF45549000-memory.dmp

Filesize
2.0MB

Download
memory/4280-80-0x000000006AC10000-0x000000006AD8D000-memory.dmp

Filesize
1.5MB

Download
memory/4592-232-0x00007FF64B230000-0x00007FF64B3EC000-memory.dmp

Filesize
1.7MB

Download
memory/4592-230-0x00007FF64B230000-0x00007FF64B3EC000-memory.dmp

Filesize
1.7MB

Download
memory/4828-30-0x00007FFF23FF0000-0x00007FFF2416A000-memory.dmp

Filesize
1.5MB

Download
memory/5024-226-0x0000000000800000-0x000000000086D000-memory.dmp

Filesize
436KB

Download
memory/5024-216-0x0000000000800000-0x000000000086D000-memory.dmp

Filesize
436KB

Download
memory/5024-217-0x0000000003CF0000-0x00000000040F0000-memory.dmp

Filesize
4.0MB

Download
memory/5024-218-0x0000000003CF0000-0x00000000040F0000-memory.dmp

Filesize
4.0MB

Download
memory/5024-219-0x00007FFF45340000-0x00007FFF45549000-memory.dmp

Filesize
2.0MB

Download
memory/5024-221-0x00000000765E0000-0x0000000076832000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads