Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe
Resource
win10v2004-20240802-en
General
-
Target
60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe
-
Size
1.8MB
-
MD5
ff315ebd7aa82f6445ffc27fa50539db
-
SHA1
47bb53469b938fc952744a157c7641454e19df55
-
SHA256
60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32
-
SHA512
497e8e75261f9e11018821b2241f72239e1fce41777c4563001bb38bcaab109a6686a91e1969ce5cebdc84a5351b7f0175446fe22ca54d7cf996ee8023fbd33e
-
SSDEEP
24576:VEeqQq3K8ZXFPLXydzhsDjQWC5zUmtdIeaV2lqAHKyS9lgMDiSeRIyI8NJ6:VEuq66XFDyWnCtUuddaklqjihhI8/6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe -
Executes dropped EXE 2 IoCs
pid Process 636 SC450061736.exe 4540 SC450061736.exe -
Loads dropped DLL 1 IoCs
pid Process 4540 SC450061736.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 636 set thread context of 4540 636 SC450061736.exe 106 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC450061736.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC450061736.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings 60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 4540 SC450061736.exe 4540 SC450061736.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4540 SC450061736.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe 2768 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 2768 3960 60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe 83 PID 3960 wrote to memory of 2768 3960 60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe 83 PID 3960 wrote to memory of 2768 3960 60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe 83 PID 2768 wrote to memory of 4484 2768 AcroRd32.exe 93 PID 2768 wrote to memory of 4484 2768 AcroRd32.exe 93 PID 2768 wrote to memory of 4484 2768 AcroRd32.exe 93 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 4328 4484 RdrCEF.exe 94 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 PID 4484 wrote to memory of 1432 4484 RdrCEF.exe 95 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SC450061736.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe"C:\Users\Admin\AppData\Local\Temp\60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SC450024181.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=377B33D58770B352BC6B38C6D0FAE0F3 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4328
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B15B28D14D4A243E7C51EA8A7A8F8460 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B15B28D14D4A243E7C51EA8A7A8F8460 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7DDE6EA14ACEA24230153B6602CCE510 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6396750B746F7F473FF9774C74630109 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3128
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=62E40A34D32E3AA30F128CCCBF25C898 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4428
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4FDB9BFA5027EDDE97422FDAD15E9D60 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4FDB9BFA5027EDDE97422FDAD15E9D60 --renderer-client-id=7 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:2504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SC450061736.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SC450061736.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:636 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SC450061736.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SC450061736.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4540
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5c2c30d146ed19ec6105de5fbf4a47aa2
SHA1ad5e36be1a80ae4fcee311a59a2aca1736e67d26
SHA2562d62e452dd86bdf77e887873f605be497a738d64f199f252b24d8c4d2d5980a3
SHA512344fc4a422cfa1a05c8f322dfeae89f8ed32a040e1a439254f42dd82371405f76d510791fcf96cf0b46a019a1fc0e7cc3cbf6ffbcf1c53cb820d443a200b1a5e
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
160KB
MD5f310cf1ff562ae14449e0167a3e1fe46
SHA185c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA5121196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
-
Filesize
1.3MB
MD5e962a1987ddf83d7050ad3752bb56cb6
SHA1378cd57c7afeeb030f7a93cec7af50526123886e
SHA25677b3eadbc24d7bafdb5ffbea389fad9722db7b563e849388510002cb759e2c00
SHA512cf58268c3cdeb4ad98892e46a8615c690b2c66d15c13cd815c8c1f98386eceecc120769936e87ace212fd0fc0716dc497691f4b7c123890823473ff328bfd68e
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
203KB
MD55be59a3550f0bbb7f14eb2dd55ba9d4d
SHA1bacb5949dec128baab9d0af68a3a58541e11484c
SHA256f87aecd38a06a7a203cfe9d445e11ba1b99b96c5d7afa5f19f50d922e9d52142
SHA512e559bfe90200a1dfa62aa6faf98641a33ad0603618b2e642d8d43e7f30b9205756646a7f8db7af69e3f92258520922164975fcbd914160cae4b7442659b6a713
-
Filesize
1.3MB
MD53a43808ca74b465f9f22ff956f13da72
SHA1d6eedf05b5a7f539c05ee5a462cd490e35da984d
SHA256b050fd2ddc0eb99ced97ea5aadecccb2041550a5443cc3656bd593db0def5247
SHA512a3472a71758b0a8e1f7d409fdf660f84843ccad503aab88fe48c3942f1a9700b91838e691e9f7af81003d305859d1602c84a579db5389148f993633a5f34a6fc
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
114KB
MD5c3311360e96fcf6ea559c40a78ede854
SHA1562ada1868020814b25b5dbbdbcb5a9feb9eb6ba
SHA2569372c1ee21c8440368f6dd8f6c9aeda24f2067056050fab9d4e050a75437d75b
SHA512fef308d10d04d9a3de7db431a9ab4a47dc120bfe0d7ae7db7e151802c426a46b00426b861e7e57ac4d6d21dde6289f278b2dbf903d4d1d6b117e77467ab9cf65