2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Resubmissions

28/12/2024, 23:58

241228-31gfhawkay 5

28/12/2024, 23:55

241228-3yg91swje1 5

28/12/2024, 23:28

241228-3gb2nsvncz 5

Analysis

max time kernel
115s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28/12/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoClicker-3.0.exe
Size

844KB
MD5

7ecfc8cd7455dd9998f7dad88f2a8a9d
SHA1

1751d9389adb1e7187afa4938a3559e58739dce6
SHA256

2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e
SHA512

cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d
SSDEEP

12288:GaWzgMg7v3qnCiWErQohh0F49CJ8lnybQg9BFg9UmTRHlM:BaHMv6CGrjBnybQg+mmhG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	AutoClicker-3.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe
3024	AutoClicker-3.0.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
3024	AutoClicker-3.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2488	2676	AcroRd32.exe	80
PID 2676 wrote to memory of 2488	2676	AcroRd32.exe	80
PID 2676 wrote to memory of 2488	2676	AcroRd32.exe	80
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 488	2488	RdrCEF.exe	81
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82
PID 2488 wrote to memory of 1916	2488	RdrCEF.exe	82

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.remouse.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff917473cb8,0x7ff917473cc8,0x7ff917473cd8
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,1306100209463864185,14491699620626950207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:4488

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\CloseCompare.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=69AA5EDE24EECA440457C37AB6E63F32 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BBAEC1038818591F005E7F79627C1AA6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BBAEC1038818591F005E7F79627C1AA6 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8DDDBB1D0738A2681C4BB6596B7502E8 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=34F491F7FB1FE12584E339B672CE1D2D --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A96CB7C1B34F867E010C0575ED0B8380 --mojo-platform-channel-handle=1888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68ebc56f52b94b2a767220c6987e27f9

SHA1
a94380c8bf42e069fa3e8e67949af0e5455275ac

SHA256
bb63090d4bada46505b87b0502e507ae02a170a8ce6223bdbf5104273fe67e50

SHA512
0cd79c4efcf81616db060eba60cab58ba5565c073c34ac66b26adacc348165fa0bfcbf5d5ac13189f02aadf08d97c4ca929cab067b42e1cff2c222faa1697554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
582be8321d23c0be703e1e002dcf9246

SHA1
c929fa4a40cd9b215f044067b0b188b84d4c46b5

SHA256
cdfccb0ec2e3e956ac6ac5f3741cf336e6bc564b0fc8b7d1252164d5bc66ca83

SHA512
53047b2205066622099e818825c4481d2257f018976f0f326bd1d6a166fd27b590ad17f083af0ad57a688554a6c1089e406d7bfe33e8ff6e86301815410bdf42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
857c182359d6dc3e31e47dec9a0750f6

SHA1
8b442d50f2b68027c7d6b467d64ffa221a5074fd

SHA256
ce5ae620cd9aace49860c77fda21ece62623622626073d47354da4b09d44cbe7

SHA512
21d0d378d2c119944c894a901859498d20f706ddc2a9f07a5b556934de671af01cb2011ff3ba4d35f3c4c701d2949c9ee151e25f5f62d0d4ec97fb5904bcddc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACLib\ACA_conf.ini

Filesize
56B

MD5
612965cb3119bfaf5545fa984a326daa

SHA1
0c5db6af6d6bd1209ed4e9073335d40d6d900ad4

SHA256
72c09d7a69a23430a60ab4a8d78a08041d9aec17292c077aaa702d625764f0a4

SHA512
69703859b2466c8a90913e60b6dcf41851dc522f609f2ff4f43527ac79e55464373a8e49a38dd9732c792c86381d16de495d7d29b165bf08002322cd4a34c1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACLib\playback.ico

Filesize
4KB

MD5
a20254ea7f9ef810c1681fa314edaa28

SHA1
fdd3040411043fa1d93efd4298db8668458b6fb8

SHA256
5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d

SHA512
4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACLib\record.ico

Filesize
4KB

MD5
1111e06679f96ff28c1e229b06ce7b41

SHA1
9fe5a6c6014b561060a640d0db02a303a35b8832

SHA256
59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6

SHA512
077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37

Download Submit