Unhappy Singlemom Private Contact From Tinder.pdf

General
Target

Unhappy Singlemom Private Contact From Tinder.pdf

Filesize

134KB

Completed

12-11-2021 03:12

Score
1/10
MD5

31875bd34e0cfca132173a0ae06e4587

SHA1

89df4672a19da938c7f31d2cdcba56f3d53b68da

SHA256

8cdca75ca32cf3f8eb2097fb651f95b89ad7dcd999036e7a4c050ff0219849cd

Malware Config
Signatures 6

Filter: none

Defense Evasion
Discovery
  • Checks processor information in registry
    AcroRd32.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzAcroRd32.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0AcroRd32.exe
  • Modifies Internet Explorer settings
    AcroRd32.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATIONAcroRd32.exe
  • Suspicious behavior: EnumeratesProcesses
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
  • Suspicious use of FindShellTrayWindow
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2108AcroRd32.exe
  • Suspicious use of SetWindowsHookEx
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
    2108AcroRd32.exe
  • Suspicious use of WriteProcessMemory
    AcroRd32.exeRdrCEF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2108 wrote to memory of 7722108AcroRd32.exeRdrCEF.exe
    PID 2108 wrote to memory of 7722108AcroRd32.exeRdrCEF.exe
    PID 2108 wrote to memory of 7722108AcroRd32.exeRdrCEF.exe
    PID 2108 wrote to memory of 43842108AcroRd32.exeRdrCEF.exe
    PID 2108 wrote to memory of 43842108AcroRd32.exeRdrCEF.exe
    PID 2108 wrote to memory of 43842108AcroRd32.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1200772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
    PID 772 wrote to memory of 1224772RdrCEF.exeRdrCEF.exe
Processes 9
  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Unhappy Singlemom Private Contact From Tinder.pdf"
    Checks processor information in registry
    Modifies Internet Explorer settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      Suspicious use of WriteProcessMemory
      PID:772
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=575E2763519C8A46D338BE71E6C9E6B8 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:1200
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B293D8FC18A9715C17980AAD9471C28C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B293D8FC18A9715C17980AAD9471C28C --renderer-client-id=2 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job /prefetch:1
        PID:1224
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7F8969885A014709BE6B414E6F2DB3E6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7F8969885A014709BE6B414E6F2DB3E6 --renderer-client-id=4 --mojo-platform-channel-handle=2076 --allow-no-sandbox-job /prefetch:1
        PID:1536
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=947B0677D9BCE28A6C0732853494AD46 --mojo-platform-channel-handle=2200 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2652
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DDF8F58353C669019687636700EEBF99 --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2636
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F50836D8AA81615F47A086B93EB80D3 --mojo-platform-channel-handle=1884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:1156
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      PID:4384
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/772-118-0x0000000000000000-mapping.dmp

                      • memory/1156-145-0x0000000000E2C000-0x0000000000E2D000-memory.dmp

                      • memory/1156-144-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/1156-146-0x0000000000000000-mapping.dmp

                      • memory/1200-123-0x0000000000120000-0x0000000000121000-memory.dmp

                      • memory/1200-122-0x0000000000000000-mapping.dmp

                      • memory/1200-121-0x000000000100D000-0x000000000100E000-memory.dmp

                      • memory/1200-120-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/1224-126-0x0000000000000000-mapping.dmp

                      • memory/1224-128-0x0000000000170000-0x0000000000171000-memory.dmp

                      • memory/1224-129-0x0000000000180000-0x0000000000181000-memory.dmp

                      • memory/1224-125-0x000000000105A000-0x000000000105B000-memory.dmp

                      • memory/1224-124-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/1536-131-0x0000000000919000-0x000000000091A000-memory.dmp

                      • memory/1536-132-0x0000000000000000-mapping.dmp

                      • memory/1536-130-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/2636-140-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/2636-141-0x0000000000965000-0x0000000000966000-memory.dmp

                      • memory/2636-142-0x0000000000000000-mapping.dmp

                      • memory/2652-136-0x00000000775B2000-0x00000000775B3000-memory.dmp

                      • memory/2652-137-0x0000000000C3E000-0x0000000000C3F000-memory.dmp

                      • memory/2652-138-0x0000000000000000-mapping.dmp

                      • memory/4384-119-0x0000000000000000-mapping.dmp