ad1eb6879e26a701034aa8c0c04632bc77cc5eaf64b7f57ec44c4ef727c552b9

General

Target

Christina Eckert 129819075.pdf
Size

6KB
MD5

a55bab4679400d734e7fafa4b64c1dcf
SHA1

e4a6e6a12e81183fdafd559e2e3506ec35626e87
SHA256

ada50d9def5e68e03d3ab1a1d601f531a8d7596b1fa8900af10f4a256f0bff4b
SHA512

f851507071907241794266c392a727731cd47e2e3d4212e534ad6c6427b69339f47f947c80ed15826128a27875afc3e14401f06a1bd21c11ca3c0757a3c36391
SSDEEP

96:BCHeGJx+rYFzGEQpPWX4MTTidISWe9HihMDn0dzyIkL0L+9T2NSzhcEq:5ccc/w+oQedEeueJxD9T2NAmr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1332 2008 WerFault.exe

pid	pid_target	process	target process
1332	2008	WerFault.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

AcroRd32.exe

pid	process
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe
4884	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4884 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

4884 AcroRd32.exe
4884 AcroRd32.exe
4884 AcroRd32.exe
4884 AcroRd32.exe
4884 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4884 wrote to memory of 1284	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 1284	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 1284	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 908	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 908	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 908	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 2588	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 2588	4884	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 2588	4884	AcroRd32.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 4028	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe
PID 2588 wrote to memory of 2372	2588	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Christina Eckert 129819075.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:1284

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:908

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B45DF030622A27E282473660B56FBB1D --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4028

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=715B9013A9C548F95646A5830ADF4812 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=715B9013A9C548F95646A5830ADF4812 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=44C4FFD148F9D526E1969C780565F779 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=44C4FFD148F9D526E1969C780565F779 --renderer-client-id=4 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A69F9D80AAB365DD1DBFB83977C2F52B --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3660

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1FBCABA15FE289EA0A7CD6076CDBC2E --mojo-platform-channel-handle=2036 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3300

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3C68C379411A58DF35B8FCA2F9227A6C --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2008 -ip 2008
1⤵
PID:3848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2008 -s 712
1⤵
- Program crash
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-133-0x0000000000000000-mapping.dmp

Download
memory/1284-132-0x0000000000000000-mapping.dmp

Download
memory/1508-144-0x0000000000000000-mapping.dmp

Download
memory/2372-139-0x0000000000000000-mapping.dmp

Download
memory/2588-134-0x0000000000000000-mapping.dmp

Download
memory/3300-152-0x0000000000000000-mapping.dmp

Download
memory/3660-149-0x0000000000000000-mapping.dmp

Download
memory/4028-136-0x0000000000000000-mapping.dmp

Download
memory/5004-155-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads