27b9d4651254eb1d39070b95576e62a8f022ac3a78b765204a09c7c14994a0d2

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2023 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plumbing Permit 44176.pdf
Size

88KB
MD5

65e8ac74d2040e85686f31e8ec3cc0d7
SHA1

dc91a1b39e7f8bf2910ccbddd7c446ab810c2ccb
SHA256

7851770fed7c7f5682c81a06db85ae4d0351b5ef8ac64256934197988d1f548f
SHA512

bf001bbf093cf04b13d42def6b48b7ed9c9627a360840b6233c7b8b55b2c2d80eb9aea495685b7568efa103d7114c248078538c4e305982033068f8e66d11bad
SSDEEP

1536:T6Anye9WFFQUPNo0AsxIe5/FJenffvGS3kU+c4h7T+zhczYZRDxQ7lRVHi:DnyU9UFUsxF5jenDZ4t6e2RDG7bdi

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2588 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

2588 AcroRd32.exe
2588 AcroRd32.exe
2588 AcroRd32.exe
2588 AcroRd32.exe
2588 AcroRd32.exe

pid	process
2588	AcroRd32.exe

pid	process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2588 wrote to memory of 4888	2588	AcroRd32.exe	RdrCEF.exe
PID 2588 wrote to memory of 4888	2588	AcroRd32.exe	RdrCEF.exe
PID 2588 wrote to memory of 4888	2588	AcroRd32.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4228	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe
PID 4888 wrote to memory of 4456	4888	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Plumbing Permit 44176.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DAE788ECE3EF9150B54D84110FFCEB22 --mojo-platform-channel-handle=1704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CEB902C36D4C86B9811091B7E814D8D1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CEB902C36D4C86B9811091B7E814D8D1 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=15EF327030E680F58296083CF8D0399D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=15EF327030E680F58296083CF8D0399D --renderer-client-id=4 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09D74588E8B91D6C8D8415ACD1FA68C4 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2821BA4417AF73C4EA7084149A672368 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5081083099009760E9A52C6C1E4FB582 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5193845b29ed91849ea8edf74c782e76

SHA1
5b6668619e45d2e5069acadabc3cd362e6a49389

SHA256
d4e0ac1e285f283dbc8cb25fd069b91d91fb4a79f66dab7b20c2b22f2b4d5635

SHA512
15e49772bb7d830c74995c3c95688a382f2683a0002a244d9e674cfde2a5baa26f57e617f6f02b7e959f2a4dc8235f5a1314f89c32ca84d8acbbd84cf6134708

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
d51b60c9ee473a07e275393d6b353562

SHA1
8a9abcd3c3c223142aece985db6364e589ad91cb

SHA256
4168e9aa6dc32e6e3b3ba94f66be4f32a952bca5fe2eaf5fd06054999daefc3b

SHA512
c13eff39eda5a6ad5b0a49b6b8afd70a6592fcc70febee56b64b320c43e33232c8cef46f6d90de67056dda3d0213fb1e66f1a9eb0dbcb0e558c0e42955468846

Download Submit
memory/2588-164-0x0000000009A70000-0x0000000009A91000-memory.dmp

Filesize
132KB

Download
memory/2588-244-0x0000000008DF0000-0x0000000008E1A000-memory.dmp

Filesize
168KB

Download