killmbr | 5536a0db0635e1e08bec0edc99d1d2e3359cb797c850d69844a16ab4cc433b2c

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Icb Temp Woofer.exe
Size 149KB
Sample260717-mljpbacy2t
SHA256 5536a0db0635e1e08bec0edc99d1d2e3359cb797c850d69844a16ab4cc433b2c
MD5 e372814977186ce7888ea942bafda582
SHA1 507d075a85b23f6ea5780ca5a8e4dbf3798f0c2d
SHA512 a726d2491c2757ac337a7902cdf9b4bff2fbcb56bf79d684aceefe8425a1062fb27612fa808e1014bc53c7668e08f30ab919ed1a2dfa33a4d8f1d9c7ad500a3b
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalRDFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWp:UsLqdufVUNDavFWFWFWFWFWFWFWFWFWE
TLSH
T165E32813AE50542FE855C9F028A5F66ABB155F361F90EE03B6D6BB0436B254372F230B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery killmbr persistence spyware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002459d-7.dat	family_killmbr

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
1672	icb temp woofer.exe
4708	icsys.icn.exe
3804	explorer.exe
4376	spoolsv.exe
2772	svchost.exe
3620	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Icb Temp Woofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icb Temp Woofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icb temp woofer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	icb temp woofer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
4708	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3804	explorer.exe
2772	svchost.exe
3528	OpenWith.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
2984	Icb Temp Woofer.exe
2984	Icb Temp Woofer.exe
4708	icsys.icn.exe
4708	icsys.icn.exe
3804	explorer.exe
3804	explorer.exe
4376	spoolsv.exe
4376	spoolsv.exe
2772	svchost.exe
2772	svchost.exe
3620	spoolsv.exe
3620	spoolsv.exe
4344	OpenWith.exe
4652	OpenWith.exe
1340	OpenWith.exe
4676	OpenWith.exe
3164	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
4696	AcroRd32.exe
4696	AcroRd32.exe
4696	AcroRd32.exe
4696	AcroRd32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1672	2984	Icb Temp Woofer.exe	86
PID 2984 wrote to memory of 4708	2984	Icb Temp Woofer.exe	87
PID 4708 wrote to memory of 3804	4708	icsys.icn.exe	88
PID 3804 wrote to memory of 4376	3804	explorer.exe	89
PID 4376 wrote to memory of 2772	4376	spoolsv.exe	90
PID 2772 wrote to memory of 3620	2772	svchost.exe	91
PID 3528 wrote to memory of 4696	3528	OpenWith.exe	102
PID 4696 wrote to memory of 3736	4696	AcroRd32.exe	105
PID 3736 wrote to memory of 2644	3736	RdrCEF.exe	106
PID 3736 wrote to memory of 5116	3736	RdrCEF.exe	107
PID 3736 wrote to memory of 5116	3736	RdrCEF.exe	107
PID 3736 wrote to memory of 1668	3736	RdrCEF.exe	108
PID 3736 wrote to memory of 4552	3736	RdrCEF.exe	109
PID 3736 wrote to memory of 3864	3736	RdrCEF.exe	110

C:\Users\Admin\AppData\Local\Temp\Icb Temp Woofer.exe
"C:\Users\Admin\AppData\Local\Temp\Icb Temp Woofer.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- \??\c:\users\admin\appdata\local\temp\icb temp woofer.exe
  "c:\users\admin\appdata\local\temp\icb temp woofer.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1672
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4708
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4376
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\appdata\local\temp\icb temp woofer.exe "
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB5815640C7025F00758276DFEC131ED --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=889780EAF4A17C03E1B7ABBCDBACF0F7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=889780EAF4A17C03E1B7ABBCDBACF0F7 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=63D6D4CEAD2B9521C4A4BF5C798CF5C8 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DEC61E2E2BE3581DEC35B20523F383B --mojo-platform-channel-handle=1980 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4B665BF576E78AF463D195A2C571514C --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icb temp woofer.exe

Path C:\Users\Admin\AppData\Local\Temp\icb temp woofer.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 8f4f95b107aeaed02c2644b79dac673b62f5fe7a4c0970eafb974fad8c3e8b57
MD5 e8d8b5899c254e216b1cefef127ab4f1
SHA1 ed1d8b8f521286b7d5350c6d996775fcf8cac7b7
SHA512 9db91a056a0429753f6f302fdc46deada678305e7a136237472b65951849c82f323fa6566e5139ab734312305ae160064b8e457ed13578bbba77f7c37ee4a73e
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXC:UVqoCl/YgjxEufVU0TbTyDDalRC
TLSH
T19ED32A376E60A42FE95286F068B9E62EB5614F350BE0BD0773A6BB04197524776F030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 b6ea22a6d47b93a607bffad199ef157bc8579d00e9ab6ed08be553188f74cde3
MD5 a1f4c724f5901d50a109af26fd5abba3
SHA1 03b3c0e2dee4fc14d72cefd3090be37a19863f5f
SHA512 134f9f158138cd8b714501d57595fba561db7dce60dc23527336dcf9f1a0c916341b58531e40f0659c4587358329f87785584e1aeb33bfef8d6e2e64a639fc6e
SSDEEP 3072:UVqoCl/YgjxEufVU0TbTyDDalRDFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFWFW2:UsLqdufVUNDavFWFWFWFWFWFWFWFWFWJ
TLSH
T1B4D30813AE50542FE855C9F028A9F66ABA155F361F90EE03B6D6BB0435B6143B2F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 61a9f781a14f5dc571bece17f9ecd4f86043bd93610de343aeb441e4cbc6b705
MD5 23064ed17b8981bb6013bbff19f51de3
SHA1 c5c29b6826c68b6ac50aa3dc4109d72611dbfaf5
SHA512 802dd158f4a37a8cfa9f2e29baae2a57314ce5e8f5e25afce0f87a2657f7a77489d5ed12169de3042d919aa5d236f723a6cbeac8fee7a159a7c7f3014f40dda0
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXR:UVqoCl/YgjxEufVU0TbTyDDalRR
TLSH
T1F5D30B236E90106FD926C5F228A6E75EFA651E361B91AC0B3753BB113A7215372F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 bcc55cc5e745f18fe31495f922e81f7aad3fb585778ee5bfdf5513ec8450ce00
MD5 1ec144697ad53809364726e7c382ffe5
SHA1 abee0a030cb56192e2fc26ef403fba69fc0bb04b
SHA512 38e3ba7cc902e928261d6ad53d05b39bc3ec5940034664f9f49c3b2c49b0054eb82d841d0f44af103caf13cfa31aa0f049aba12ca5a2e6107755d40882878c76
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXH:UVqoCl/YgjxEufVU0TbTyDDalRH
TLSH
T1E8D3F927BF10443ED862C6F51CE5E66ABA621F351BD4AE033256778428712837AF931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2772-70-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2984-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2984-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3620-43-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3804-69-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4376-44-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4708-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download