dba16684914ce045e221f472cbe2ea9b86ecc9c5cc448d1163867a0a1c06aa27

General

Target

Poziv za seminar iz Javnih nabavki - Neum - Oktobar 2022. - web.pdf
Size

541KB
MD5

51d86f52c46494cca0d3e9b0b64d7684
SHA1

b9a56bf91c382b2013d182102d44c087f57cdb10
SHA256

dba16684914ce045e221f472cbe2ea9b86ecc9c5cc448d1163867a0a1c06aa27
SHA512

0ff72b4ffc2ae542832dd2f3253f44c313c5737d19db02c14827f5e4aa26988f8b95780fef814a068d4f63c9dd54d475251feb4da0fe0b3009b76a9b8bb3f7df
SSDEEP

12288:RgVb8MPhk0pXKQInuCW3NRbCTZDJXS3TCWpKgBmoYogtfEgEfS:KVoqhK6j3uTPXSpKgBmAgpSS

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

5076 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

5076 AcroRd32.exe
5076 AcroRd32.exe
5076 AcroRd32.exe
5076 AcroRd32.exe
5076 AcroRd32.exe
5076 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 5076 wrote to memory of 4456	5076	AcroRd32.exe	RdrCEF.exe
PID 5076 wrote to memory of 4456	5076	AcroRd32.exe	RdrCEF.exe
PID 5076 wrote to memory of 4456	5076	AcroRd32.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 1632	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe
PID 4456 wrote to memory of 4004	4456	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Poziv za seminar iz Javnih nabavki - Neum - Oktobar 2022. - web.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=315EAA692BDE0EC3432DA3B3B109CAE7 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E63DAB192FC077375E6CE34EF5A0BD28 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E63DAB192FC077375E6CE34EF5A0BD28 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4004

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=82B01ED8DA040D5D63CA6DCC5D82B283 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=361111CA1836DC00F0E766C05E8E77E2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=361111CA1836DC00F0E766C05E8E77E2 --renderer-client-id=5 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1944

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38DA8E13B32F2DA5E27FF04088A58082 --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3116

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3ACDC56E1C8D31F38002DE553E693B24 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-153-0x0000000000000000-mapping.dmp

Download
memory/1632-134-0x0000000000000000-mapping.dmp

Download
memory/1944-145-0x0000000000000000-mapping.dmp

Download
memory/3116-150-0x0000000000000000-mapping.dmp

Download
memory/4004-137-0x0000000000000000-mapping.dmp

Download
memory/4344-142-0x0000000000000000-mapping.dmp

Download
memory/4456-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads