hawkeye | 2cd607fb44480b61c90e5107a3131231936c99a7b766dbed4df4c6fed325ae0f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe
Size

951KB
MD5

c521f79249320c77b5b20007f871fbb1
SHA1

8b772e27c77fd4880b79fe8466bff21e21e1aa2a
SHA256

2cd607fb44480b61c90e5107a3131231936c99a7b766dbed4df4c6fed325ae0f
SHA512

f471c23576f61e2066e09c44ae3beab374153fdafebfb6cc03e140942c15d3fa273394848dd3a4ba0bd07c7883b678d0d2dcbc1be1ea5a381882b101e55107bb
SSDEEP

24576:9Sr69b1sIzdkdUDuCppG/HNs2HRT3s4ni4gSUf4:B9b1xdySu84lsMRzVniLw

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 9 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4028-17-0x0000000000400000-0x0000000004B18000-memory.dmp	Nirsoft
behavioral2/memory/3008-37-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3008-35-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3008-34-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3008-39-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/2968-71-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/2968-74-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/2968-72-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/2968-81-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4028-17-0x0000000000400000-0x0000000004B18000-memory.dmp	MailPassView
behavioral2/memory/3008-37-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3008-35-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3008-34-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3008-39-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4028-17-0x0000000000400000-0x0000000004B18000-memory.dmp	WebBrowserPassView
behavioral2/memory/2968-71-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/2968-74-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/2968-72-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/2968-81-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	M.exe

Executes dropped EXE 2 IoCs

pid	Process
2456	M.exe
4028	M.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	M.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	whatismyipaddress.com
15	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 4028	2456	M.exe	84
PID 4028 set thread context of 3008	4028	M.exe	88
PID 4028 set thread context of 2968	4028	M.exe	103

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b72-5.dat	upx
behavioral2/memory/2456-6-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/2456-25-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	M.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2456	M.exe
2456	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe
4028	M.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	M.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	AcroRd32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2456	M.exe
2456	M.exe
4028	M.exe
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2456	3016	c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe	83
PID 3016 wrote to memory of 2456	3016	c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe	83
PID 3016 wrote to memory of 2456	3016	c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe	83
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 2456 wrote to memory of 4028	2456	M.exe	84
PID 4028 wrote to memory of 3032	4028	M.exe	86
PID 4028 wrote to memory of 3032	4028	M.exe	86
PID 4028 wrote to memory of 3032	4028	M.exe	86
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 4028 wrote to memory of 3008	4028	M.exe	88
PID 3032 wrote to memory of 616	3032	AcroRd32.exe	90
PID 3032 wrote to memory of 616	3032	AcroRd32.exe	90
PID 3032 wrote to memory of 616	3032	AcroRd32.exe	90
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91
PID 616 wrote to memory of 1092	616	RdrCEF.exe	91

C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c521f79249320c77b5b20007f871fbb1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:616
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D234FD33C677FCD7B740198EEC136EAE --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2335F9CFDE3813C84293A9A23DB4A950 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2335F9CFDE3813C84293A9A23DB4A950 --renderer-client-id=2 --mojo-platform-channel-handle=1804 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A0E5B60D2F50853EC27CC95CCEE2F20A --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AD570094EE0708ECB07C8E8F1D20C688 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2843E2ACDAD26B644D4413047606F879 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2843E2ACDAD26B644D4413047606F879 --renderer-client-id=6 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C3B435898B86BB65BBB56B48F1724BBF --mojo-platform-channel-handle=2728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:3008
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
c9a7e5fc6d1ed825239d6c335a23401f

SHA1
78616cf7dee43efc38ad4c824bfe3ff83f3cc749

SHA256
3121a2dc33fd277b0c7a17a95fa54665248f039eaa181aad656168970d969e57

SHA512
8cfecf041691734108d31022a4177703d7261535ae373c64eb7624dfba3f25d3fe25b6dae67c9b932ad3627576dca6cd12522189dc8aee687d27089e56acf63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf

Filesize
76KB

MD5
a044a4eaea50ac33f65fd614f4b78509

SHA1
f4c1d9a86ee7769492293508f650f67dc3c523f7

SHA256
8f9c44049129703f3d6d3beeff6ac8d576df276a56e8f7f85c86beda912ed8c4

SHA512
9fbeae185958d0c7868bc21fd08220cc8e1f6aaa6cea14ffbb257a93355ba043e294be25ae40c8f80d75563bdd1f9cec3f29afa944b3cac11664ec4b066822d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_

Filesize
749KB

MD5
aa9da8f4f5e434d8449c17efccebef5e

SHA1
99487070bb0da9e0c2df138b111e9bebc2a271f2

SHA256
16b6bdc384d7b4821d541eb40f1be8c3ca2b027b9a329e77eb4c13800b3e8ec2

SHA512
768fb0d93c91ad868f7b2cfc0fc67ce2e20293e40ec1e4216bb805232a2f02cdfd3ec225c29c40bed6c4f505aa35b788f5291661b99d2773c24d395c825ef0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

Filesize
104KB

MD5
7bae06cbe364bb42b8c34fcfb90e3ebd

SHA1
79129af7efa46244da0676607242f0a6b7e12e78

SHA256
6ceaebd55b4a542ef64be1d6971fcfe802e67e2027366c52faacc8a8d325ec7a

SHA512
c599b72500a5c17cd5c4a81fcf220a95925aa0e5ad72aa92dd1a469fe6e3c23590c548a0be7ec2c4dbd737511a0a79c1c46436867cf7f0c4df21f8dcea9686cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe

Filesize
140KB

MD5
bc9932d562808f046db8cf2d225b317e

SHA1
50827e282cb74b846b8ef79ccd3f5887e3a941f2

SHA256
49a50d91166a62cb0c1454d015af0b5b98ea86702c9e88c21f6e5775517571b7

SHA512
d46153b9d0260a076fd6247de14325b2f76d7537139677af927427fab23852258634b525a1e3e31e19456a04a5c58527ac351f44b475c2eb984294b30b0efa22

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
memory/2456-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2456-15-0x00000000022B0000-0x00000000022B5000-memory.dmp

Filesize
20KB

Download
memory/2456-6-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2968-81-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2968-80-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/2968-71-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2968-72-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2968-74-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3008-34-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3008-39-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3008-35-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3008-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4028-41-0x0000000073E70000-0x0000000074421000-memory.dmp

Filesize
5.7MB

Download
memory/4028-69-0x0000000073E70000-0x0000000074421000-memory.dmp

Filesize
5.7MB

Download
memory/4028-40-0x0000000073E72000-0x0000000073E73000-memory.dmp

Filesize
4KB

Download
memory/4028-26-0x0000000073E70000-0x0000000074421000-memory.dmp

Filesize
5.7MB

Download
memory/4028-17-0x0000000000400000-0x0000000004B18000-memory.dmp

Filesize
71.1MB

Download
memory/4028-23-0x0000000073E70000-0x0000000074421000-memory.dmp

Filesize
5.7MB

Download
memory/4028-22-0x0000000073E70000-0x0000000074421000-memory.dmp

Filesize
5.7MB

Download
memory/4028-21-0x0000000073E72000-0x0000000073E73000-memory.dmp

Filesize
4KB

Download