f92d6f283637135463e4db7033843e9bdfee83b28ddde74b250f1670421125d0

Analysis

max time kernel
31s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2022 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

privacy_policy.pdf
Size

167KB
MD5

624e0c3f58e76dda59b2bad545b14904
SHA1

50257d4c4bd3afb63421d3c9384a4f6124d815d5
SHA256

f92d6f283637135463e4db7033843e9bdfee83b28ddde74b250f1670421125d0
SHA512

cc0f144287902a584453cd42222dfcb442714a63adfd3b76d7e493441f55ef75edf0d1e200bbb7412613693c3ac0478f4674aa22919824f9c658b24831918e23
SSDEEP

3072:q1bScXThJ85ys4j+W2PeudKTxCbMR1toe9DK45gAblg7W5Uf6mLkJy3w1ejZ0b2W:q1GY0OLQeugngAlg7W5Uf6mLkJy3w1em

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3100	1316	AcroRd32.exe	85
PID 1316 wrote to memory of 3100	1316	AcroRd32.exe	85
PID 1316 wrote to memory of 3100	1316	AcroRd32.exe	85
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3480	3100	RdrCEF.exe	88
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89
PID 3100 wrote to memory of 3628	3100	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\privacy_policy.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1FD43CA3B065FF9C39EC8CEB91D107E1 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D7903EC804F50135452DCECA7A67F847 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D7903EC804F50135452DCECA7A67F847 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=895F3D451B8696B1F507FE26111531EA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=895F3D451B8696B1F507FE26111531EA --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CE74679E79782186FDF96BEE0E63ACA7 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE038EE0F3C958AC3F4D060466DA045D --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3124
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6862ECA6D398ECD4A54E93AD09A310BE --mojo-platform-channel-handle=2616 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads