593e29f008abba930b284b916c7a424e045868f8a7f7a7037082253cf0b24248

General

Target

Receipt_33523367_from_ENK_General_Trading_LLC.pdf
Size

46KB
MD5

c3dc6d7d15ec7dbaf77183a29f9fc61f
SHA1

316a91c16d27bd7b9129174178c86b3e89aae453
SHA256

8e037b2f9860904fdc0b8ffcdcc1cb1ec234b6f572a588f09823084b2886b0b9
SHA512

4972eda68205ba939ed0e3042e0f88ec9490530ca805a5b473a4a83d2654d19dc36b0afeb5c42df95b9a04e143b5acf3356ac96b36e503743b9ca24904031383
SSDEEP

768:hBNXgNhP89pV0mRl57Q/YDpMAW1LGUt/tv0tAPEG1HA03bZfwGZW+X2arJzqQVSH:FlxQCpMAWFGUtFv0tA8uBbZfmxarwQfY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

AcroRd32.exe

pid	process
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe
4932	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4932 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4932 AcroRd32.exe
4932 AcroRd32.exe
4932 AcroRd32.exe
4932 AcroRd32.exe
4932 AcroRd32.exe
4932 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4932 wrote to memory of 884	4932	AcroRd32.exe	RdrCEF.exe
PID 4932 wrote to memory of 884	4932	AcroRd32.exe	RdrCEF.exe
PID 4932 wrote to memory of 884	4932	AcroRd32.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 1456	884	RdrCEF.exe	RdrCEF.exe
PID 4932 wrote to memory of 4664	4932	AcroRd32.exe	RdrCEF.exe
PID 4932 wrote to memory of 4664	4932	AcroRd32.exe	RdrCEF.exe
PID 4932 wrote to memory of 4664	4932	AcroRd32.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe
PID 884 wrote to memory of 2368	884	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Receipt_33523367_from_ENK_General_Trading_LLC.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ECD4503D5F98214147FE38A8177C9927 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2BC2D12F03E46337CCD6CBFA13F8E2D5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2BC2D12F03E46337CCD6CBFA13F8E2D5 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2368

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=59C07A0867209E7ECC98795AECA03507 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=59C07A0867209E7ECC98795AECA03507 --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4140

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F148FB4C66FEB51AF6A06E4FE88A713D --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1000

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27AC836FBD9ABE81C3A847486597E6A2 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=490C8F152B9C3A0C1DA406BE3B0A10B4 --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3280

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:4664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-132-0x0000000000000000-mapping.dmp

Download
memory/1000-148-0x0000000000000000-mapping.dmp

Download
memory/1456-134-0x0000000000000000-mapping.dmp

Download
memory/2368-138-0x0000000000000000-mapping.dmp

Download
memory/2704-151-0x0000000000000000-mapping.dmp

Download
memory/3280-154-0x0000000000000000-mapping.dmp

Download
memory/4140-143-0x0000000000000000-mapping.dmp

Download
memory/4664-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads