291c4eff37088c440be8f7a3854cda663cc66bc3307e2955fb4d9731ad46d342

Reason

Machine shutdown

General

Target

JOHNNY OLIVER - Attachment: PDF: MOD - Systems in Action Part 1.pdf
Size

1.2MB
MD5

421ed9fa2a569e627cd8ca5dd2c36309
SHA1

ca1eddb079c0c9d1850f1098488e2c6ae4d7ef46
SHA256

291c4eff37088c440be8f7a3854cda663cc66bc3307e2955fb4d9731ad46d342
SHA512

639ad7c47a7b3d2a03b5653b1ba6ecfe14eb308f7fcc53ce128b44740b97894530cbc848a94d587d586d19fdf46ec9ba97fc9a3c3310c1c7fa06533182b73d33
SSDEEP

24576:OGVQjcVf5vfjxKdUJEGve15LsimvFbfMkVq2xOmDcRxKZhPv:O8V5fj9LmMlz82xMoV

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe
4472	AcroRd32.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
656
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4472 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exeLogonUI.exe

pid process

4472 AcroRd32.exe
4472 AcroRd32.exe
4472 AcroRd32.exe
4472 AcroRd32.exe
3964 LogonUI.exe

pid
4
4
4
4
4
656

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4472 wrote to memory of 1504	4472	AcroRd32.exe	RdrCEF.exe
PID 4472 wrote to memory of 1504	4472	AcroRd32.exe	RdrCEF.exe
PID 4472 wrote to memory of 1504	4472	AcroRd32.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1700	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe
PID 1504 wrote to memory of 1128	1504	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JOHNNY OLIVER - Attachment_ PDF_ MOD - Systems in Action Part 1.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=425C6F4AF51D51C6F4CEC034BD40BD4C --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1700

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3F22F964110FAFDECD15F11FD5DEA5E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3F22F964110FAFDECD15F11FD5DEA5E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1128

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E491183003144180155BB7576AF3A9E --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1980

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A37E1F941BB75205882555F5CE2CD536 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3868

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ABDC674E0DF99DD4387420424CA5E315 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4352

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E105721BA00D32075BA85D1E42BEA930 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E105721BA00D32075BA85D1E42BEA930 --renderer-client-id=7 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4388

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ac855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
6cac79b26e33ee1264f632edf16a2abb

SHA1
2d2ece557800ac14caafcc38a2a71e6762a18d73

SHA256
d32595ae4cf9ceaf8fd56b87a7207d33633b3e8722cf3e048b0f714284e48e96

SHA512
71ca8152e53b95ea1cf9900e2eada102c4059eecd36545dab92b786888e2c1fbdfd29a379df5a2b39f4a0443fe237856b973916f4038f22eee7efbc070356dce

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads