e453f80c50082fca88205edbed20390ded04da33edb435d2bfe309ee7ce9877f

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21dcccab539125a4e645e48c180de16e_JaffaCakes118.pdf
Size 12KB
Sample240703-lfxtbaweqf
SHA256 e453f80c50082fca88205edbed20390ded04da33edb435d2bfe309ee7ce9877f
MD5 21dcccab539125a4e645e48c180de16e
SHA1 8a07351302031389962bd3e8cdc272661d13f9c0
SHA512 9d4613ee9210dbb7fd4d89474f59214b1c10d625c41722f958589cc28c82f00e97277ab3b183654738fd882accfbb1437399673349d10f5c416c9e32c2db43dc
SSDEEP 384:JlPz4ULMxLIKXHwSbtyaz1mszrkbEEh9B7uwzMv0sKKikQV:Jlb/uZXpMaz1msXEXnzNsRC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	AcroRd32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1792	1864	AcroRd32.exe	81
PID 1864 wrote to memory of 1792	1864	AcroRd32.exe	81
PID 1864 wrote to memory of 1792	1864	AcroRd32.exe	81
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 2344	1792	RdrCEF.exe	82
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83
PID 1792 wrote to memory of 388	1792	RdrCEF.exe	83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\21dcccab539125a4e645e48c180de16e_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=03E39955370BDFD0A2156BED108C9633 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F171091256FEF9E9D3F066C927594699 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F171091256FEF9E9D3F066C927594699 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=14701F567589DCB4D9D908108727B686 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=14701F567589DCB4D9D908108727B686 --renderer-client-id=4 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=551A21FB0D342E6511889CC6031ADEF9 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4364
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=11127AF170B8B8190A452C968EE618C8 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3264
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3ADB5E075AC090E35B111391C5E5BD0A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3ADB5E075AC090E35B111391C5E5BD0A --renderer-client-id=7 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F260B9AC2BD0384989CA01683B21ED4 --mojo-platform-channel-handle=3068 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 31840827795d56bc7e59bd93e6cdacd196d8bb94216de6ab1416d8215a119e17
MD5 48ee42ca3a1933cfb2fcd2dab07a322b
SHA1 1b1e1807fcbda2048926af4fbdb2408165de5a29
SHA512 208e98acd1b67a38503800e0e3029cb3e8c668e6529af63ecba340bbfb48747b75720aaf01d05222891fe06b012e1b86dd4f07cb920cccb914fe8938094a4ea2
SSDEEP 384:yeMdThPytELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:2y+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 ed16eeca04973675b91a801d61fbf2ab0203e0166a108f6cf8cbb691177ceaf4
MD5 ad0da75ea69f48160049be2fecf8cfec
SHA1 858f08a85424148db7ce02b408d6a1c9406ecc5f
SHA512 6d4778ad1e6732edf2c6704b112bad3d1a999804bcee8be38f8f990e3268121b3d4a3450ab61c1e5d129dca697a6778e7ac7546b29bea01424e9849d2277bf90
SSDEEP 384:ie7dThPytELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:Ly+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1864-37-0x0000000009D30000-0x0000000009D51000-memory.dmp

Download