ardamax | ca51ea1a54804c695b5be9377708a753d10aa328c00f77e5721c0850262901bb

Analysis

max time kernel
94s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe
Size

1.6MB
MD5

f807c44efd479acf6bc30c119ad3ae8e
SHA1

abee762034cedd860ef101bf511c9fc8af5aafe1
SHA256

ca51ea1a54804c695b5be9377708a753d10aa328c00f77e5721c0850262901bb
SHA512

3618439d2d9faa9a4d9340e3f62cb80e95e1fe0624ae8d087665936ec8e97e86d588622664395609be4e5f055a11494e5c0d47c88d07fbbe898d918c215ad2b5
SSDEEP

49152:7MMMMMMMMMMMMMMMMMMQMMMMMMMMMMMMMMMMMMAHI/F+MQXUrq51Z8q5Vk1eE6Ff:7MMMMMMMMMMMMMMMMMMQMMMMMMMMMMMT

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023469-33.dat	family_ardamax

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	1hh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	KSJF.exe

Executes dropped EXE 3 IoCs

pid	Process
3740	1hr-rar.exe
520	1hh.exe
3636	KSJF.exe

Loads dropped DLL 9 IoCs

pid	Process
520	1hh.exe
3636	KSJF.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
3636	KSJF.exe
3636	KSJF.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
2236	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KSJF Agent = "C:\\Windows\\SysWOW64\\28463\\KSJF.exe"	KSJF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\AKV.exe	1hh.exe
File opened for modification	C:\Windows\SysWOW64\28463	KSJF.exe
File created	C:\Windows\SysWOW64\28463\KSJF.001	1hh.exe
File created	C:\Windows\SysWOW64\28463\KSJF.006	1hh.exe
File created	C:\Windows\SysWOW64\28463\KSJF.007	1hh.exe
File created	C:\Windows\SysWOW64\28463\KSJF.exe	1hh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	3636	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1hr-rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1hh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KSJF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3636	KSJF.exe
Token: SeIncBasePriorityPrivilege	3636	KSJF.exe
Token: SeIncBasePriorityPrivilege	3636	KSJF.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4184	AcroRd32.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4184	AcroRd32.exe
3636	KSJF.exe
3636	KSJF.exe
3636	KSJF.exe
3636	KSJF.exe
4184	AcroRd32.exe
3636	KSJF.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 3740	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	82
PID 1504 wrote to memory of 3740	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	82
PID 1504 wrote to memory of 3740	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	82
PID 3740 wrote to memory of 520	3740	1hr-rar.exe	83
PID 3740 wrote to memory of 520	3740	1hr-rar.exe	83
PID 3740 wrote to memory of 520	3740	1hr-rar.exe	83
PID 1504 wrote to memory of 4184	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	84
PID 1504 wrote to memory of 4184	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	84
PID 1504 wrote to memory of 4184	1504	f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe	84
PID 520 wrote to memory of 3636	520	1hh.exe	85
PID 520 wrote to memory of 3636	520	1hh.exe	85
PID 520 wrote to memory of 3636	520	1hh.exe	85
PID 4184 wrote to memory of 2168	4184	AcroRd32.exe	87
PID 4184 wrote to memory of 2168	4184	AcroRd32.exe	87
PID 4184 wrote to memory of 2168	4184	AcroRd32.exe	87
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 1836	2168	RdrCEF.exe	88
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89
PID 2168 wrote to memory of 2836	2168	RdrCEF.exe	89

C:\Users\Admin\AppData\Local\Temp\f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f807c44efd479acf6bc30c119ad3ae8e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\1hr-rar.exe
  "C:\Users\Admin\AppData\Local\Temp\1hr-rar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\1hh.exe
    "C:\Users\Admin\AppData\Local\Temp\1hh.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SysWOW64\28463\KSJF.exe
      "C:\Windows\system32\28463\KSJF.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 1068
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\KSJF.exe > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\adresse3.pdf"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4B87FE4FBE768B3CF2942D89E3DBFCED --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1836
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8CBBB30286A46C4F46E645FC0DF12E20 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8CBBB30286A46C4F46E645FC0DF12E20 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF96CA7F9C3D283CBF97902235A8FC09 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3328
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A3E0EDDD4B581559B22FAEA31F19922 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1856
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DF7BBB8CAE4AE48EBA5BCE94F0BEECD9 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=063B568E8AEFC35ED63ED9A6D4AE08AC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=063B568E8AEFC35ED63ED9A6D4AE08AC --renderer-client-id=7 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3636 -ip 3636
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e91134f64c96075ff47a6e241af3a0fe

SHA1
d955fd0614851c60a3b84c7e25bde8c73f028270

SHA256
2dfd9b6f0dbc310fa86f85a36ebc81e6f786ccc8c65ca4b277fec99d38bd3873

SHA512
3e45fc9bd1ef016428c4002c418288e82106e222f1ab2831cd311c3622f84ff1f3a2d45ffe6e773387eee7493ca3d6c267fd9c6312718fb1cafbaa63753ee979

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1hh.exe

Filesize
818KB

MD5
1f9b544cc6163459788f14296a8f8269

SHA1
d0da238b70ced133453b03cc8e766a9e8a12b238

SHA256
925bc753883e2041eaacb28a00134cc91414c15cecaf6daf78600282895bea1b

SHA512
cbc01666ef0339d6cd7ed343cf22643d35f62802e2e45716700ed5882574b3c88c97e28448c7b3a9454e38a8202eb4e9866eef44b641d3c377500a8fb75cb230

Download Submit
C:\Users\Admin\AppData\Local\Temp\1hr-rar.exe

Filesize
1.5MB

MD5
64aa2628496fac3e1e2749fd1a8d0eae

SHA1
7b60e03fc3b2776223794a3adfcb1b4af823654e

SHA256
8887ff75260f84f335bc9f32a60d83e2975574e3c41a68b1e7d0b194b33c0c92

SHA512
847247fee2fbb80904b111ed43c69478d7c031bb037a29795e192e8e3bfa66be9d63a55887634d231b5a30901b14629f1a1895013363e11244e010e3a97eca57

Download Submit
C:\Users\Admin\AppData\Local\Temp\@8722.tmp

Filesize
4KB

MD5
a55cbc0f0125b005ef369020b4c17806

SHA1
010af3e2e84b337e91f5e0c791b01e1d527211ce

SHA256
27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637

SHA512
88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be

Download Submit
C:\Users\Admin\AppData\Local\Temp\adresse3.pdf

Filesize
44KB

MD5
f86217c174b81244e93256ae926165a8

SHA1
861e7d2f12f7bbbf1c333a6f833dcccc607cf41b

SHA256
36e868748fdf55d8638505844370c7097a69ec0a3e5058dc5a388b82ab80225a

SHA512
04c7a75d3250a4d05aea44e6de4f76e3f10aa4fc9e6fc30a3f6c7ac45b4a93ccc48e36333785536866de98175822eaa13d211eaff5028394ac06131b9319eb6b

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
46ccfd974518e5849738449034a05a17

SHA1
d391108816aed7ba8f7beb205ad7171c74eae6b2

SHA256
571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

SHA512
773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

Download Submit
C:\Windows\SysWOW64\28463\KSJF.001

Filesize
398B

MD5
66d4aad7ee46b069c5d0ed1a088c805f

SHA1
95c55688a2907909d65013af3e88f9f91f700309

SHA256
db23f8e5a317fb1c14c95f1579b1efae103a33c3ab1c2568a9ea3c6a09c52620

SHA512
b90820141d1307dee9e8a29964e774e7cad98444a668d1a9a71590314eee3667daceafb2d30a291ff7b20faa85bef67816cf40e12990c1750ab21299874d0dac

Download Submit
C:\Windows\SysWOW64\28463\KSJF.006

Filesize
8KB

MD5
395bbef326fa5ad1216b23f5debf167b

SHA1
aa4a7334b5a693b3f0d6f47b568e0d13a593d782

SHA256
7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

SHA512
dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

Download Submit
C:\Windows\SysWOW64\28463\KSJF.007

Filesize
5KB

MD5
1b5e72f0ebd49cf146f9ae68d792ffe5

SHA1
1e90a69c12b9a849fbbac0670296b07331c1cf87

SHA256
8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

SHA512
6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

Download Submit
C:\Windows\SysWOW64\28463\KSJF.exe

Filesize
912KB

MD5
6768ba61744862704760b66ce8f8fdd4

SHA1
e86cbed8cf20c2a9c76219d0c434bc310ffb2392

SHA256
4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0

SHA512
eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61

Download Submit
memory/3636-81-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3636-40-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3636-179-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download