053b0c4feb91a817d475e793e43ddb2cb299b894ca8b8188ae6dbd3904842b72

General

Target

NEW_ITEMS_2021105130.pdf
Size

187KB
MD5

40380dd9415d973db89f779ee0f474d4
SHA1

a428c8265bee9027c92cd95510d7bcecf82cde10
SHA256

053b0c4feb91a817d475e793e43ddb2cb299b894ca8b8188ae6dbd3904842b72
SHA512

e33686fcf1217515d1f1d9c66755b9bca32b604c2ada3409119d9be11499fcc1960c9476bc9c4239167ae87a25811997ced140bc007f3aaef003a153c878e0bd

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

AcroRd32.exe

pid	process
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe
2360	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2360 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

2360 AcroRd32.exe
2360 AcroRd32.exe
2360 AcroRd32.exe
2360 AcroRd32.exe
2360 AcroRd32.exe
2360 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2360 wrote to memory of 1328	2360	AcroRd32.exe	RdrCEF.exe
PID 2360 wrote to memory of 1328	2360	AcroRd32.exe	RdrCEF.exe
PID 2360 wrote to memory of 1328	2360	AcroRd32.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3300	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe
PID 1328 wrote to memory of 3676	1328	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEW_ITEMS_2021105130.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AB81E0D3CC28792763B2D866F7C6938B --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3300

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F28BDA2D9D6A9B2D5B153AE1088FDE06 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F28BDA2D9D6A9B2D5B153AE1088FDE06 --renderer-client-id=2 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=73F3E9BBAA9336284E76D3B107561D8B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=73F3E9BBAA9336284E76D3B107561D8B --renderer-client-id=4 --mojo-platform-channel-handle=2072 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1952

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E28B6E262F3F554BAFF1BE83018F6D32 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3DD4B37D2D28ACD83AD335ACAE25233F --mojo-platform-channel-handle=2500 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B7D511B675B2A9EA68B105DBD8BF49E2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-115-0x0000000000000000-mapping.dmp

Download
memory/1352-142-0x0000000000000000-mapping.dmp

Download
memory/1352-141-0x0000000001356000-0x0000000001357000-memory.dmp

Filesize
4KB

Download
memory/1352-140-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/1380-138-0x0000000000000000-mapping.dmp

Download
memory/1380-137-0x00000000008D8000-0x00000000008D9000-memory.dmp

Filesize
4KB

Download
memory/1380-136-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/1952-126-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/1952-128-0x0000000000000000-mapping.dmp

Download
memory/1952-127-0x000000000135E000-0x000000000135F000-memory.dmp

Filesize
4KB

Download
memory/3132-134-0x0000000000000000-mapping.dmp

Download
memory/3132-132-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/3132-133-0x000000000135B000-0x000000000135C000-memory.dmp

Filesize
4KB

Download
memory/3300-116-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/3300-117-0x0000000001298000-0x0000000001299000-memory.dmp

Filesize
4KB

Download
memory/3300-118-0x0000000000000000-mapping.dmp

Download
memory/3300-119-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3676-125-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/3676-124-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3676-122-0x0000000000000000-mapping.dmp

Download
memory/3676-121-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3676-120-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads