c745ecf2d91252de768e0e86035ba001393e0596428e2753a5d60d9cc1927155

General

Target

d24e997b005abf5b1d1a06635125deadf2d8e1af7534cb6008deac54cd0a9c44.pdf
Size

13KB
MD5

04a35fafb904fb03ba87b9a2fdb5208b
SHA1

9e6aeaafeb2e9890d448ae58bbb8c63065e85f57
SHA256

d24e997b005abf5b1d1a06635125deadf2d8e1af7534cb6008deac54cd0a9c44
SHA512

a1388fa8d56f8d42495b76cca115ed7c2b89d03d970c348b974afd0c1d2cb7e37d7c7b644bad1ddca39852bc394e17da4761e7bdcf681702ae9245ea1181acdd
SSDEEP

384:L0SHDMl7f25kSuuUBCUSh2grKYfpHeV7nUt4ukmpyUCUS4:3spruw+2dqpHeVbRuff3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe
4172	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4172 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4172 AcroRd32.exe
4172 AcroRd32.exe
4172 AcroRd32.exe
4172 AcroRd32.exe
4172 AcroRd32.exe
4172 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4172 wrote to memory of 5024	4172	AcroRd32.exe	RdrCEF.exe
PID 4172 wrote to memory of 5024	4172	AcroRd32.exe	RdrCEF.exe
PID 4172 wrote to memory of 5024	4172	AcroRd32.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3648	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe
PID 5024 wrote to memory of 3632	5024	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d24e997b005abf5b1d1a06635125deadf2d8e1af7534cb6008deac54cd0a9c44.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2A8CFCEE3A7CA5744D52ECF2FBEDE0DA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2A8CFCEE3A7CA5744D52ECF2FBEDE0DA --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3648

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=10B9E80FE319836312C3C6EF23222217 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=358A2B62C90D7C41F6055434E24537EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=358A2B62C90D7C41F6055434E24537EC --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7F196FEF7F2446F835614ADA05ABF86 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2348

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=00995156C829F35B3D3A4C73CA848BA2 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2156

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E0E472521CB813D5788767641833757E --mojo-platform-channel-handle=2500 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-142-0x0000000000000000-mapping.dmp

Download
memory/2156-150-0x0000000000000000-mapping.dmp

Download
memory/2348-147-0x0000000000000000-mapping.dmp

Download
memory/3632-137-0x0000000000000000-mapping.dmp

Download
memory/3648-134-0x0000000000000000-mapping.dmp

Download
memory/3912-153-0x0000000000000000-mapping.dmp

Download
memory/5024-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads