759a62a1d7e2935c1e3898be2853ca90ef10dba4da89639a577f867342923488

Resubmissions

07-08-2024 08:22

240807-j91e7avgrp 3

06-08-2024 23:44

240806-3rmk6avaml 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ-virus
Size

247KB
MD5

6be096a120a7ed29c5f0e1438c229297
SHA1

9bd59fa300a6a1f92614299513ed3ff942f6b628
SHA256

759a62a1d7e2935c1e3898be2853ca90ef10dba4da89639a577f867342923488
SHA512

e4f366ce09535fd36ef002fd679a3dc20b9d62d838e2aa3a76004a4437455fdca3546d0baec83de84ad0b37ebdec7ca800464d3ca6d8365729071121484badf3
SSDEEP

6144:83ojA3uokeOvHS1d1+sNs8wbiWQ29fvZJT3CqbMrhryf65NRPaCieMjAkvCJv1VP:OojA3uokeOvHS1d1+sNs8wbiWQ29fvZY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8BCFFB4B-5496-11EF-9912-762C928CCA03} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4208	vlc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4208	vlc.exe
5496	OpenWith.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4688	iexplore.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1744	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
1204	OpenWith.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
464	AcroRd32.exe
2216	OpenWith.exe
884	OpenWith.exe
464	AcroRd32.exe
2224	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4872	OpenWith.exe
4208	vlc.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe
5496	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 1204 wrote to memory of 464	1204	OpenWith.exe	96
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 464 wrote to memory of 5724	464	AcroRd32.exe	98
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 1568	5724	RdrCEF.exe	99
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100
PID 5724 wrote to memory of 2380	5724	RdrCEF.exe	100

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MEMZ-virus
1⤵
PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9991D827B6C74BEA7B4CEB9DB77DC7A --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7CD7EFC4A503ED297550A2122EBB0D77 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7CD7EFC4A503ED297550A2122EBB0D77 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2380
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC6C53BAEC39F110D80D40491DBF78D2 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1872
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1FC460FAF53C3105FA3D2396C830723F --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1556
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E16DDFEF1FF5E3B9522610753F2C54E --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4872
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\MEMZ-virus
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:4688
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4688 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
54d7dc83a47aeb7061a8ee33f81f71c0

SHA1
97c7af33c2a7dab57c9b3b00823fc8552adc6426

SHA256
b8b1aa0f77c7c347dc89d4a321b57169b352ca9b85e44df00793360fb2ffef09

SHA512
6d7963ac692a49f3b9b3da33cfb47d8308021ab53b2ce796fd770aacb354c115fc10e26c9794c864564de8fd46ca48178fdab9bf61b4e3f7ab30292e41f3433f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97-22592575c2af[1].js

Filesize
732KB

MD5
530131150b9b046556026a4efd6879d1

SHA1
8aad346cf9885a09d7b3a890455204928ad0c345

SHA256
2ae4af027e21b86b4c28dd509eddb2065525758a1f8c006c59ec457a54cf6a43

SHA512
22592575c2afd324e58fd953add23a2c633e77ab9927c3b0309c66ba97371b6b542f227f43757d4f994779472b1a35315233ade985dcb609b6c9e799b193206e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_ActionList_index_js-1567f1132a28[1].js

Filesize
25KB

MD5
98249ce74ed3ee339b54fb4bf2a55bfd

SHA1
e4304a66b3323e0910e236f5266b16f31f092512

SHA256
de9f25a82b14bd0569ba5922452b2a56b3208acce439cfa86913d194396610b3

SHA512
1567f1132a280bb6f8412a3874fefa7f7619c0b518b31ca57d3f86a8ab177cb9b95058f7b152d15bf658628d35762e3ee16d7e929489b1fe9a05bf9aa7b26871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_ActionMenu_ActionMenu_js-node_modules_primer_react_-5b2420-048f91dcedb3[1].js

Filesize
11KB

MD5
218a4f17ec81d77e6993d662dfafa371

SHA1
68fc5b9958fd5d6a13f129124cb476b15402869b

SHA256
81e7364ac0e52fc78a6c101fd3a8bbd5bf3a853ba2f5cb193fa58aff730de783

SHA512
048f91dcedb34a0dd855c9e3649fa798d1f7bab05ea21fe7e5acc786406bc480f38c62c1b5c992da935969081a8330ca555212e87e175e7ed273748192f5518d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\vendors-node_modules_primer_react_lib-esm_Text_Text_js-node_modules_primer_react_lib-esm_Text-7845da-3bcd176ee601[2].js

Filesize
12KB

MD5
1178a1c26bca6089c3d1a14a1a7796fa

SHA1
80716636c86bdf40d51e685ccf3587d6a1507602

SHA256
4118b27822d5f1ea83a013cad3f3ec7bb877a42ea4239b71ed3399d0cbe8be62

SHA512
3bcd176ee601e186433bfb0c3e11f8f719eaaf4851da2c1d4186bfde69f6a0cd93ec0b690eb5eb8cf97ac05d99bf976f2105621774d0b18af7c8bdaecba1d581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\notifications-subscriptions-menu-0d65b3211924[1].js

Filesize
17KB

MD5
0db96d7f52da51c4092fef0d8ece7def

SHA1
50462ae4581e1b80ae0f0b3f510b40bcd21858ff

SHA256
34c530f425a0b57af9a0b7c8bc1231928bb5a700ce74c08723e38eb6ad4389e9

SHA512
0d65b32119242463b901688a42327cc66ba02cb92f93216fe5d2383f5b74b463cfd46a5263be4546b239b1fdf60226144df2e43b411f6a8d9c5ef47e845d7623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\react-lib-7b7b5264f6c1[1].js

Filesize
209KB

MD5
c0772c4a7a3f6a29256a69e8feca82d8

SHA1
75ff0ed2d25d36f7c6e933030e691228e37c5264

SHA256
4736f0203a41862c10e5b93529b15897813bca088a8dc952250ba7c19b6901d9

SHA512
7b7b5264f6c11eb55aca6b7788e67f89f5638a53c75589dfebdb7e08f6fcad5b2555a90eeff60da4578ee429cbbdf1d886f55a30355d9386d7006241e65ee632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c-7a1e99981675[1].js

Filesize
11KB

MD5
6018298e98a0ad492381a57a3a56f2fd

SHA1
c2335a94d01ef3f2d7576ac1e45196a7690cc5ce

SHA256
ef5c7df244fa748c4a3019634dc4653dffb9e373c43478753cd4d9c19b5574e0

SHA512
7a1e9998167556d279ee6f541c91e0bc09158689a5420f7c0d240f703409a6b7ca840eb3296cd034b3439d6c335690bf50e5982e9467efe94e2468c6feb6b9a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-e91295e60abd[1].js

Filesize
28KB

MD5
59b1ccfeba4c676ba96ca28766640910

SHA1
5504c5a8e3355794f4e7771241c274b98cbcb303

SHA256
494a827200d1e11e4c08519cc0c7fff57c999e9a47763decd5ec6623faca5611

SHA512
e91295e60abd95b3bfc9d11c8db34001da35c4e5982cf58b57c32e6eee688e19454545346cb0e3b8e15fa92aac2729cb2c522fd38be8b7b7b4a193b805bcc6eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Box_Box_js-55a9038b54f0[1].js

Filesize
15KB

MD5
c660c2ee0360a1d18bebeb12641857ee

SHA1
6fa2bc02090373854b6bcaa15096f517018c375a

SHA256
0aef521ca83330f959d3fce2efef9175fdeb618c55c79ebda619d1a8a87987e2

SHA512
55a9038b54f031de7844ce356e22d2e2a145f4b2f7c0453439586079be60cedafc3eb4f45219ffe9ce2beae21e1a67f12523db049f948e7ce777aef7cdd2b788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Button_Button_js-e151c17189c8[1].js

Filesize
16KB

MD5
d1b6c4d10b97500009f14c00cf8a0be0

SHA1
ea5b8b06e1f430c486878804af0d9ab5fd27152a

SHA256
280e90e10922fca82f776c10e40f9d692fda0474723fbbb9aaff77ac42cd5908

SHA512
e151c17189c816b447272668e70a272452a27e67a86cb890e8ec50237cffda8db22eb43c2e668f9d7c14953c12eeb8edafd6d5610f6fbb7d9bb417563e3fa50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_Dialog_js-node_modules_primer_react_lib-esm_Feature-c10078-66f672e84f85[2].js

Filesize
24KB

MD5
ec433b10644913d396c58fb6876a8eb1

SHA1
e9c9f65266cfea2b9438d347e24916630726d008

SHA256
a6bc8c0b839313d2535706ae820585d176b7e872e1538f134e0c9385827542c9

SHA512
66f672e84f8568bcf78a163f388a1c93532a313c70f8f77142c0adbd5a420b3dc9420186369fae54ce06b044901bebb6c5c59ae91e075b555eabf44d7a84bb29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_FormControl_FormControl_js-f4892e323732[1].js

Filesize
32KB

MD5
4d242c877c9b9246f46b94fc08fb4e4c

SHA1
af8ec815ccf5d32837d180ae5c0a17386d0d248d

SHA256
df6bcbce702dc764939564644e83fdbc27b1efd7cafe91d575bcef6bd94af688

SHA512
f4892e323732dc64c5a4dd297efdcf652a38599c599a1f06aea9f6b255cdd7963186fefd5545f712a1ed01094288d548a39e471a7f317baa4e80056d7b91d737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_SelectPanel_SelectPanel_js-da4b9b447323[1].js

Filesize
16KB

MD5
bd47d0364adf68cb6093326f3bc4bda3

SHA1
132b43c39bc8e56171c8ed84faa698bd87b0fe00

SHA256
aeb4edf36de310adb09773ee0d8254fd5ef85bdeeb865d93458be8217a88c7ca

SHA512
da4b9b447323077fb6127b23b9256b3aa2ea752be80c3adced1f7bea49454fac9c2a6f3174645262e89a074618cffed9b6ee83f1677f70fb622217e797920d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYI0S376\vendors-node_modules_primer_react_lib-esm_TooltipV2_Tooltip_js-ffca9cf46775[1].js

Filesize
14KB

MD5
a4fc81ffee4da6704a3cab4386917a48

SHA1
2f1b15888f3987e6c4c43eb0087402da29f6197d

SHA256
50d8979e13f1d0b3e2b887ff7f251796bd481493d647e456ed7ffe14c822de89

SHA512
ffca9cf4677540790208c03fb19503ce29214d2ea3cf60303de8b0b90d34282271a905ea8df439ee125802fcebc58c625d53f7f2d6654733f34b57638ef64086

Download Submit
memory/464-123-0x000000000A1A0000-0x000000000A44B000-memory.dmp

Filesize
2.7MB

Download
memory/4208-137-0x00007FF8A90E0000-0x00007FF8A90F1000-memory.dmp

Filesize
68KB

Download
memory/4208-134-0x00007FF8ACAB0000-0x00007FF8ACAC7000-memory.dmp

Filesize
92KB

Download
memory/4208-143-0x00007FF8A8BD0000-0x00007FF8A8BF1000-memory.dmp

Filesize
132KB

Download
memory/4208-142-0x00007FF89A270000-0x00007FF89A2B1000-memory.dmp

Filesize
260KB

Download
memory/4208-141-0x00007FF8978A0000-0x00007FF898950000-memory.dmp

Filesize
16.7MB

Download
memory/4208-145-0x00007FF8A8A90000-0x00007FF8A8AA1000-memory.dmp

Filesize
68KB

Download
memory/4208-148-0x00007FF896FD0000-0x00007FF897223000-memory.dmp

Filesize
2.3MB

Download
memory/4208-146-0x00007FF8A8290000-0x00007FF8A82A1000-memory.dmp

Filesize
68KB

Download
memory/4208-147-0x00007FF8A8270000-0x00007FF8A8281000-memory.dmp

Filesize
68KB

Download
memory/4208-144-0x00007FF8A8AB0000-0x00007FF8A8AC8000-memory.dmp

Filesize
96KB

Download
memory/4208-135-0x00007FF8AC6A0000-0x00007FF8AC6B1000-memory.dmp

Filesize
68KB

Download
memory/4208-136-0x00007FF8AC5F0000-0x00007FF8AC607000-memory.dmp

Filesize
92KB

Download
memory/4208-132-0x00007FF898950000-0x00007FF898C06000-memory.dmp

Filesize
2.7MB

Download
memory/4208-140-0x00007FF899860000-0x00007FF899A6B000-memory.dmp

Filesize
2.0MB

Download
memory/4208-138-0x00007FF8A8CB0000-0x00007FF8A8CCD000-memory.dmp

Filesize
116KB

Download
memory/4208-139-0x00007FF8A8C90000-0x00007FF8A8CA1000-memory.dmp

Filesize
68KB

Download
memory/4208-133-0x00007FF8ACC90000-0x00007FF8ACCA8000-memory.dmp

Filesize
96KB

Download
memory/4208-130-0x00007FF6C8D30000-0x00007FF6C8E28000-memory.dmp

Filesize
992KB

Download
memory/4208-131-0x00007FF8A8CD0000-0x00007FF8A8D04000-memory.dmp

Filesize
208KB

Download
memory/4208-526-0x00007FF8978A0000-0x00007FF898950000-memory.dmp

Filesize
16.7MB

Download