90435781fdc2ed824e908816831889e546ef4a1bc26648b997d8076899e51c60

Analysis

max time kernel
197s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kiddions_menu/Readme.md/spec/data/20070313 - 2nd Laptop Battery.pdf
Size

27KB
MD5

be3427795b673615e42f89b9043d44d9
SHA1

9cf4b4b3f312894a0a49157c40ca623a7c1b5fb2
SHA256

764d06d90fa96d89f770693bf91e165a433d2f86786174f88f2590e24549593d
SHA512

95d45928874c2932c44149c86ea45e86591dbbc1fef1f1ae52a9d45ca3d8a166c8ebbc0cdd06c0fcc102174b4015095417ec91677951eb414dd40ca188d85571
SSDEEP

768:R+fCGsC2nhdy/SwZkcjNTar+e0X6huWzjwXBs6RW7v5E8b:AsC2S/Hk03VT66VcdZb

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

756 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

756 AcroRd32.exe
756 AcroRd32.exe
756 AcroRd32.exe
756 AcroRd32.exe

pid	process
756	AcroRd32.exe

pid	process
756	AcroRd32.exe
756	AcroRd32.exe
756	AcroRd32.exe
756	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 756 wrote to memory of 1304	756	AcroRd32.exe	RdrCEF.exe
PID 756 wrote to memory of 1304	756	AcroRd32.exe	RdrCEF.exe
PID 756 wrote to memory of 1304	756	AcroRd32.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 4832	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe
PID 1304 wrote to memory of 672	1304	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kiddions_menu\Readme.md\spec\data\20070313 - 2nd Laptop Battery.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C0CF62E9AE93D3CB173F58D783A5CAD9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C0CF62E9AE93D3CB173F58D783A5CAD9 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1DC07EEA15FDE0010214CF89235799DE --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:672

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F6E7A4A4B79BFA1479509D39EA94BB76 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5ACA58F1325C8A29A1416EE679D72EB --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4032

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0ECC2A5D055DB71C02437920EB4D095A --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B7F4D8C78EE8EE593428A1A9E819D17B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B7F4D8C78EE8EE593428A1A9E819D17B --renderer-client-id=7 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-137-0x0000000000000000-mapping.dmp

Download
memory/1304-132-0x0000000000000000-mapping.dmp

Download
memory/1936-151-0x0000000000000000-mapping.dmp

Download
memory/3848-148-0x0000000000000000-mapping.dmp

Download
memory/3932-142-0x0000000000000000-mapping.dmp

Download
memory/4032-145-0x0000000000000000-mapping.dmp

Download
memory/4832-134-0x0000000000000000-mapping.dmp

Download