hawkeye | 12d16205504a26ca42877320e0dd4adc6c44e0c9314fc9bc07b0ca900f08db58

Analysis

max time kernel
124s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhpDataObject._fdp.exe
Size

2.9MB
MD5

b194af41cab7bf7d0a4818a31c23271f
SHA1

924244e1cd05e292a4ca710f03573b2f6f8d5a4f
SHA256

ddbd74f87f973b4a96f5d08e87fc6553154a913a7beed65113f3010fd99fccdc
SHA512

eaed2565185ceb323a158a4f4a2105910fd643726050772ecdb750b2eab7bb20e57d4774715654cb3bc3ec26d690847fcea2df1b689842d0ab3aff4c19bbb110
SSDEEP

24576:rZQtqBorTlYWBhE+V3mON3BeGixx6YC34gizrpT8FDn+UPk++H0uUP3XXuQ4kP86:rKtqFWM4mEI9jCod/gX/+Hy

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000a000000023b65-9.dat	Nirsoft
behavioral2/memory/936-29-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/936-30-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/936-32-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3312-61-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/3312-62-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/3312-69-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/files/0x000a000000023b65-9.dat	MailPassView
behavioral2/memory/936-29-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/936-30-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/936-32-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000a000000023b65-9.dat	WebBrowserPassView
behavioral2/memory/3312-61-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/3312-62-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/3312-69-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	PhpDataObject._fdp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Windows Update.exe

Deletes itself 1 IoCs

pid	Process
3844	Windows Update.exe

Executes dropped EXE 1 IoCs

pid	Process
3844	Windows Update.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3844 set thread context of 936	3844	Windows Update.exe	86
PID 3844 set thread context of 3312	3844	Windows Update.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PhpDataObject._fdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	Windows Update.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3312	vbc.exe
3312	vbc.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
3844	Windows Update.exe
3844	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	Windows Update.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3844	Windows Update.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe
220	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3844	4084	PhpDataObject._fdp.exe	83
PID 4084 wrote to memory of 3844	4084	PhpDataObject._fdp.exe	83
PID 4084 wrote to memory of 3844	4084	PhpDataObject._fdp.exe	83
PID 3844 wrote to memory of 220	3844	Windows Update.exe	85
PID 3844 wrote to memory of 220	3844	Windows Update.exe	85
PID 3844 wrote to memory of 220	3844	Windows Update.exe	85
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 3844 wrote to memory of 936	3844	Windows Update.exe	86
PID 220 wrote to memory of 5080	220	AcroRd32.exe	87
PID 220 wrote to memory of 5080	220	AcroRd32.exe	87
PID 220 wrote to memory of 5080	220	AcroRd32.exe	87
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 3308	5080	RdrCEF.exe	88
PID 5080 wrote to memory of 1132	5080	RdrCEF.exe	89
PID 5080 wrote to memory of 1132	5080	RdrCEF.exe	89
PID 5080 wrote to memory of 1132	5080	RdrCEF.exe	89
PID 5080 wrote to memory of 1132	5080	RdrCEF.exe	89
PID 5080 wrote to memory of 1132	5080	RdrCEF.exe	89

C:\Users\Admin\AppData\Local\Temp\PhpDataObject._fdp.exe
"C:\Users\Admin\AppData\Local\Temp\PhpDataObject._fdp.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Roaming\Windows Update.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB428704D2D5D6D66394AA027DE8AE35 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=90009F3FFF48C24C3DE371BF454C25AE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=90009F3FFF48C24C3DE371BF454C25AE --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1132
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A05FD1E12CE64E02876CEA722CD3741 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8ABA3C700AF1706D35B74494E734DE80 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C15D899874D2DFA8AC1E5E97627436D --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BA442D85726817F92AD986A9C2882B50 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BA442D85726817F92AD986A9C2882B50 --renderer-client-id=7 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:920
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:936
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f08e4e1b061326bb67f2dd3d03f6d15c

SHA1
1372ebf9d71f20dd00e6fa10bf7a3f0c60f6acaf

SHA256
7c15ba84c2dc0de65762f1a688ef923112c8bea0a10a6e257e571a2a5899a2c4

SHA512
e7dde966a6f1364571acf5d0aa5e748ffea66ae0e87e6a27718a92a7f6d2cf76934ace146ddf1f5b1d59be6b6162183848441eae73101a19c4aa1bda4de3ba2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf

Filesize
853KB

MD5
80efc6aa19efc275b68050edefcbc414

SHA1
dae55a079ca7456e528b0c9926383c713fd7493b

SHA256
ff6f1b548b98c1278c9a80fdf40c653cc537fed639d8a16dce7f77cf91fb9a04

SHA512
b2f611d9abf7c435b1f061720038bff174c0d247e4f4aefbed98644501e15480b4bcecdc17d1a37695f008081085482d271a5059ebef2e5b3d32f348d85671ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
56B

MD5
d8f7513092f5de5d4573d609f40f2e48

SHA1
98340d14a2da04c2c866613ea07290f051b50b1a

SHA256
fa0ceb58d336a38786702b102dae743569fb4ef3c72b210ac456c27d83b7b7d4

SHA512
18d1241e0998d48643fde6888e31f258bbbc6e1dfa1a26f01948a56cbad3478f2707cbe173d9594411d5fc01ddd46bd87b3b639eb705f2253f66727f982e366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
2.9MB

MD5
b194af41cab7bf7d0a4818a31c23271f

SHA1
924244e1cd05e292a4ca710f03573b2f6f8d5a4f

SHA256
ddbd74f87f973b4a96f5d08e87fc6553154a913a7beed65113f3010fd99fccdc

SHA512
eaed2565185ceb323a158a4f4a2105910fd643726050772ecdb750b2eab7bb20e57d4774715654cb3bc3ec26d690847fcea2df1b689842d0ab3aff4c19bbb110

Download Submit
memory/936-32-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/936-30-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/936-29-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3312-62-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3312-69-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3312-61-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3844-18-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3844-57-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3844-59-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3844-60-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3844-19-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/3844-20-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-17-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-0-0x0000000074D02000-0x0000000074D03000-memory.dmp

Filesize
4KB

Download
memory/4084-3-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-2-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download
memory/4084-1-0x0000000074D00000-0x00000000752B1000-memory.dmp

Filesize
5.7MB

Download