970e904f3117b9eba451fd9e1b6b74fab0c09d979e17d4d9d199c7051d3e5b5e

Analysis

max time kernel
142s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7072b01ad97906c3263aec888b898e5e.pdf
Size

35KB
MD5

7072b01ad97906c3263aec888b898e5e
SHA1

2822b7aa3255a3bb114b02437da4d3c9307188e7
SHA256

970e904f3117b9eba451fd9e1b6b74fab0c09d979e17d4d9d199c7051d3e5b5e
SHA512

1feb1f272da89e511d918bd6dee73b6af08856f779a894eea93d934affd2990d6b45175b8b40b4bbe1ef329ae99da9506036a4865e6d64eee3e686d833e96d9d
SSDEEP

768:n8PIDafgocUJr7o7z5fRuPvZMQXNrK2kv72kSNG5Kb0tz0Dm7K6Orrorh:t/F4AAItoDNBrErh

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe
836	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2668	836	AcroRd32.exe	93
PID 836 wrote to memory of 2668	836	AcroRd32.exe	93
PID 836 wrote to memory of 2668	836	AcroRd32.exe	93
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 2368	2668	RdrCEF.exe	95
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94
PID 2668 wrote to memory of 1684	2668	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7072b01ad97906c3263aec888b898e5e.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0FFB2FA492B238C7EAC2A666F734E1E8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0FFB2FA492B238C7EAC2A666F734E1E8 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D4A3D3A0FD06B286DE6ADE5857AAAB1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2368
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=409BE49117D748779D06E3DCE2A4D25D --mojo-platform-channel-handle=2284 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E7D6295B4C86B577C4EA4AEB8CB9BD6 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F3916F04A8EB7A48BD1BAA1A5328638 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3136
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E8950AFBEC0E928127CA89D5D14A0C45 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E8950AFBEC0E928127CA89D5D14A0C45 --renderer-client-id=7 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
58KB

MD5
a606bde03848d1a3d804e2deda12b441

SHA1
77ee06df688e5ef75fbb1d458c37efe19a504faa

SHA256
6a6d1ac1c2371a87b96f915c8f5d6d9138f11ca38d9849a2889ecd8f7f2a6d57

SHA512
a5d092fde1219cbc0903ded9e380c85164dc66ba9a30f9370912681a99d5c07e950a3ce202222987d38dde7722c1ab89fabe15288f63df0b56e99e10c9bc879a

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
4KB

MD5
9576fd1ceba7466f85e118c718d0f090

SHA1
483cc10e930b4b47f744568a4fe851af35f8ab50

SHA256
7ae1ae1c1d7d7265cfa7704356e1607b35bb86e414b9d39cee17a474dbf3e348

SHA512
ad1bd7eb5c0508ab41432a890f506f5911945b6537668949e6afd454ff683c23915bde713217e2391c5f0fe60f4c9b45c13fa4f056985598b6b99597afdb46a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
14KB

MD5
5b60c91d61b36dee34c6c21ac8c19031

SHA1
1b5859e30987a24ad988f7123290df77c5455be3

SHA256
e02302130487d236d94e0e4ebd4075eebb72526e8c5d5fe6907a92ca20ee0875

SHA512
12f0238734fefa550970ee623516bc1dfd4c201f7ca685734083a4e22f8cba8bb7a107be643b0e0948269a1477d933e5724b28390fea91844fe09d0c36642571

Download Submit