IOC Report
Candace McCalmant . lnv#00148765.pdf

Files

File Path

Type

Category

Malicious

Candace McCalmant . lnv#00148765.pdf

PDF document, version 1.7

initial sample

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\02d53571-baac-439b-a0be-fd24487fd436.tmp

JSON data

modified

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029172148Z-165.bmp

PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Certificate, Version=3

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

SQLite 3.x database, last written using SQLite version 3040000, file counter 20, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 20

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Temp\MSI47efb.LOG

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 13-21-46-181.log

ASCII text, with very long lines (393)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

ASCII text, with very long lines (393), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\62f12ec8-c1df-4f27-8fa7-e2a3b0fb82b5.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\859bc19c-b3a5-47a9-867c-21de7ed0f398.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\c52bdf62-ff22-41b7-ad9d-76bc1d32d5a1.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\fb9b1500-bc91-48a5-816e-2e9130beffb7.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081

dropped

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

ASCII text

dropped

There are 17 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Candace McCalmant . lnv#00148765.pdf"

Details

Is windows:	true
Is dropped:	false
PID:	6548
Target ID:	0
Parent PID:	1028
Name:	Acrobat.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Candace McCalmant . lnv#00148765.pdf"
Size:	5641176
MD5:	24EAD1C46A47022347DC0F05F6EFBB8C
Time:	13:21:42
Date:	29/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff686a00000
Modulesize:	5693440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

Details

Is windows:	true
Is dropped:	false
PID:	6524
Target ID:	2
Parent PID:	6548
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	13:21:43
Date:	29/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6413e0000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1652,i,2167151873984966525,17673108332368890896,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5968
Target ID:	4
Parent PID:	6524
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1652,i,2167151873984966525,17673108332368890896,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	13:21:43
Date:	29/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6413e0000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://x1.i.lencr.org/

unknown

Domains

Name

IP

Malicious

x1.i.lencr.org

unknown

Details

Name:	x1.i.lencr.org
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

aFS

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

tDIText

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

tFileName

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

tFileSource

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

sFileAncestors

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

sDI

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

sDate

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

uFileSize

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

uPageCount

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

sAssetId

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1

bisSharedFile

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

aFS

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

tDIText

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

tFileName

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

sDI

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

sDate

HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2

uFileSize

There are 7 hidden registries, click here to show them.