xworm | 66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3e

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe
Size

552KB
MD5

10bbf67948e6dddb51f6f08d018c0af0
SHA1

241eca0187de98f65f76253e1ea8998f5d51fbe5
SHA256

66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3e
SHA512

f6b2b3b2e0ca98ce80a55962c6778a94d7d2d6b7f25999965fc0a466f8d095fe729fbdc346049c9d90d76212e05314d16dcd3f28066cc51b93c9ca4883cfdfd2
SSDEEP

6144:I5vWMUYDhcGHAsDkeA5IvxDmUAI+K366Ujge5DAtAvKhAp081nNVjqKoeS:IxWCDhVXA5IvQ0mjgAPy6nnjqKoeS

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

4SlUuKAVMJTCYjjd

Attributes

Install_directory
%AppData%
install_file
pdf.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023b7c-25.dat	family_xworm
behavioral2/memory/5088-34-0x0000000000D10000-0x0000000000D3A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	StubSoftware.exe

Executes dropped EXE 2 IoCs

pid	Process
3192	StubSoftware.exe
5088	pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\pdf	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StubSoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	StubSoftware.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe
Token: SeDebugPrivilege	5088	pdf.exe
Token: SeDebugPrivilege	3192	StubSoftware.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3192	1840	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe	92
PID 1840 wrote to memory of 3192	1840	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe	92
PID 1840 wrote to memory of 3192	1840	66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe	92
PID 3192 wrote to memory of 5088	3192	StubSoftware.exe	94
PID 3192 wrote to memory of 5088	3192	StubSoftware.exe	94
PID 3192 wrote to memory of 1728	3192	StubSoftware.exe	95
PID 3192 wrote to memory of 1728	3192	StubSoftware.exe	95
PID 3192 wrote to memory of 1728	3192	StubSoftware.exe	95
PID 1728 wrote to memory of 1960	1728	AcroRd32.exe	100
PID 1728 wrote to memory of 1960	1728	AcroRd32.exe	100
PID 1728 wrote to memory of 1960	1728	AcroRd32.exe	100
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 2280	1960	RdrCEF.exe	101
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102
PID 1960 wrote to memory of 1748	1960	RdrCEF.exe	102

C:\Users\Admin\AppData\Local\Temp\66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe
"C:\Users\Admin\AppData\Local\Temp\66d19a418b63a7d1fe5aedb22b4632f65588cd8b4bff4873c0a1938585009e3eN.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\StubSoftware.exe
  "C:\Users\Admin\AppData\Local\Temp\StubSoftware.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\pdf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2024.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD752E22924A1626F236BB93282605C2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6E0D247F15E453BB5367B9D6B2BB0CFC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6E0D247F15E453BB5367B9D6B2BB0CFC --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76E85C982E128FD1DC1E7368F68E3B17 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0030C09A7530C89754D6B4D69A817D1B --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4444
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E8430B16919F3AD9CD2B59738B2ED20B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E8430B16919F3AD9CD2B59738B2ED20B --renderer-client-id=6 --mojo-platform-channel-handle=2376 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9B3A11BECE564B1C60C146D620236F8 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
87333f6f1a1af525d1d4f30f65e72bc4

SHA1
3f36c77fc6f35b6748e134abd52117af04daad61

SHA256
debdd021d86f9b37ac1fec2965e54062e2225377c692d7dc7e24eceb10970333

SHA512
ef6579196e7f30bc734d84929fed8f8922ecac0d3d1b55095aff1c7893d542620ddad02eb8969379d57c4f5c4f4312834f87924f633497918586fec12e442c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024.pdf

Filesize
19KB

MD5
1bfe03726985e5f00d6493bae4d7733e

SHA1
8aa97a35f4136255e515fee32a9e7494a59cf36b

SHA256
3d14fcb12f470412cc85d15ae4a84210c4ee5cd79455dd18000ce7ef7c3828e1

SHA512
6a65118e9d3da7ab65b1c2e2d8dadce2e15f5b5b35c5db934681a826486e69602532e87cf4a99154100aa63a0fb341b7fbc105a26819d506a35063d621bb0681

Download Submit
C:\Users\Admin\AppData\Local\Temp\StubSoftware.exe

Filesize
225KB

MD5
14d355e2281f4132311311fa31b84607

SHA1
ff44c91fde76f9d5e7482092bf9f8b45ae7bada8

SHA256
4620e089eccef262e3cf156e04104aa7ab5724a71e814e56113568cd0df3985e

SHA512
b8b2b250b03084eba7c407cfe99bfb6e19fe7a9b06472136468c85890391012e01b28126ee23040472127a8df2d5d66ae8620ccc2bbf9dfd3c5f4a9c82ed1249

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdf.exe

Filesize
143KB

MD5
250fcb3398d262e5cf16ef67feb71787

SHA1
94acc26f63f9fe050fc37a4c4de91dd5259a077c

SHA256
4ac349e2b8c861c982779353a473f600e64f8a0e9a92a00778c2a330dc852576

SHA512
d05ebc06412fbcb229b05248b899c7f49d480179eaa77a4b80a769577b66b9924f9f05b41dc87a42d859c2d284572dcd923926a1ce8746feb150463471598ad7

Download Submit
memory/1840-1-0x0000000000070000-0x00000000000E6000-memory.dmp

Filesize
472KB

Download
memory/1840-2-0x00007FF974D60000-0x00007FF975821000-memory.dmp

Filesize
10.8MB

Download
memory/1840-14-0x00007FF974D60000-0x00007FF975821000-memory.dmp

Filesize
10.8MB

Download
memory/1840-0-0x00007FF974D63000-0x00007FF974D65000-memory.dmp

Filesize
8KB

Download
memory/3192-18-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/3192-19-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/3192-35-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/3192-20-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/3192-17-0x0000000005450000-0x00000000059F4000-memory.dmp

Filesize
5.6MB

Download
memory/3192-16-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/3192-15-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/5088-34-0x0000000000D10000-0x0000000000D3A000-memory.dmp

Filesize
168KB

Download