43274872974.pdf

General
Target

43274872974.pdf

Filesize

73KB

Completed

15-11-2021 07:46

Score
1/10
MD5

9487e9816477653d55451fb9c08fe1ff

SHA1

2a28faa1946b1c87ba7ecaa2813a53e8fbc0583f

SHA256

6cce6ce9359732cd7cfe944b23758dd5d95b5d27373d66f387da9ddab4f50642

Malware Config
Signatures 6

Filter: none

Defense Evasion
Discovery
  • Checks processor information in registry
    AcroRd32.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0AcroRd32.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzAcroRd32.exe
  • Modifies Internet Explorer settings
    AcroRd32.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATIONAcroRd32.exe
  • Suspicious behavior: EnumeratesProcesses
    AcroRd32.exe

    Reported IOCs

    pidprocess
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
  • Suspicious use of FindShellTrayWindow
    AcroRd32.exe

    Reported IOCs

    pidprocess
    3688AcroRd32.exe
  • Suspicious use of SetWindowsHookEx
    AcroRd32.exe

    Reported IOCs

    pidprocess
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
    3688AcroRd32.exe
  • Suspicious use of WriteProcessMemory
    AcroRd32.exeRdrCEF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3688 wrote to memory of 40923688AcroRd32.exeRdrCEF.exe
    PID 3688 wrote to memory of 40923688AcroRd32.exeRdrCEF.exe
    PID 3688 wrote to memory of 40923688AcroRd32.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 37524092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
    PID 4092 wrote to memory of 34804092RdrCEF.exeRdrCEF.exe
Processes 8
  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\43274872974.pdf"
    Checks processor information in registry
    Modifies Internet Explorer settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE7B10E9F0684FA3C5BAC627B517295E --mojo-platform-channel-handle=1632 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:3752
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3D73B55D0138B44D56E9FEDEE3DC0B66 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3D73B55D0138B44D56E9FEDEE3DC0B66 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
        PID:3480
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8CFED20AD225E015B59CC5A8AC64DBC2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8CFED20AD225E015B59CC5A8AC64DBC2 --renderer-client-id=4 --mojo-platform-channel-handle=2236 --allow-no-sandbox-job /prefetch:1
        PID:3532
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C20A52FE324DBC51B32A1B017ECF2999 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:724
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=23DEA73F5788D2E891717230DEE8A31F --mojo-platform-channel-handle=2616 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2328
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7AFE82A6251AE65AD824FBABF5D91A38 --mojo-platform-channel-handle=2780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2248
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/724-137-0x0000000000000000-mapping.dmp

                      • memory/724-136-0x0000000001111000-0x0000000001112000-memory.dmp

                      • memory/724-135-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/2248-144-0x0000000000DB9000-0x0000000000DBA000-memory.dmp

                      • memory/2248-145-0x0000000000000000-mapping.dmp

                      • memory/2248-143-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/2328-141-0x0000000000000000-mapping.dmp

                      • memory/2328-140-0x0000000000FD9000-0x0000000000FDA000-memory.dmp

                      • memory/2328-139-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/3480-127-0x0000000001380000-0x0000000001381000-memory.dmp

                      • memory/3480-125-0x0000000000000000-mapping.dmp

                      • memory/3480-124-0x0000000001368000-0x0000000001369000-memory.dmp

                      • memory/3480-122-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/3480-128-0x0000000001390000-0x0000000001391000-memory.dmp

                      • memory/3532-129-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/3532-131-0x0000000000000000-mapping.dmp

                      • memory/3532-130-0x0000000000B2F000-0x0000000000B30000-memory.dmp

                      • memory/3752-119-0x0000000077082000-0x0000000077083000-memory.dmp

                      • memory/3752-120-0x0000000001181000-0x0000000001182000-memory.dmp

                      • memory/3752-121-0x0000000000000000-mapping.dmp

                      • memory/3752-123-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

                      • memory/4092-118-0x0000000000000000-mapping.dmp