a3b0d1022bfd03281a9557378f045e6d4208305d3ffd7a2cb889d4cd285f2a1e

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70a98074ee0087e19a5458ded44305a0.pdf
Size

103KB
MD5

70a98074ee0087e19a5458ded44305a0
SHA1

4328cc1d7a0d4be6ce39c32a120e7a5e40c4df51
SHA256

a3b0d1022bfd03281a9557378f045e6d4208305d3ffd7a2cb889d4cd285f2a1e
SHA512

88968244ff24b03b89f89b3bd9925285c6ba943e168658ac820abdef15bf45d441017ddc408576734b775427012a53344dae9a7c63eef1b2b1df933e12db10af
SSDEEP

1536:1UYOFeITE7xwP8Ua5TYoPgmU3fBmz0B7IEXaF2REvbDQqLOHXtRniADJ/GT:qhFJA7O36TxIf5AWOEEb1aHdRniAN4

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe
4624	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1812	4624	AcroRd32.exe	92
PID 4624 wrote to memory of 1812	4624	AcroRd32.exe	92
PID 4624 wrote to memory of 1812	4624	AcroRd32.exe	92
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1040	1812	RdrCEF.exe	94
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93
PID 1812 wrote to memory of 1272	1812	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\70a98074ee0087e19a5458ded44305a0.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D7C5AE105F8533BCE9907905D198E427 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D7C5AE105F8533BCE9907905D198E427 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6CA3DFFB8F72A531EC093295C64A29BC --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AB5C8D0E0B0EF7634C7FF9D5FC8BFEF0 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=13E9B9C6012C1C3680F3BB25213BFA20 --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3076
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA53F4A55A24EB72157EBC75E7C526D6 --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=10041B6D2E7D2B73943BD19A7CEA2D31 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=10041B6D2E7D2B73943BD19A7CEA2D31 --renderer-client-id=8 --mojo-platform-channel-handle=2472 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
6KB

MD5
b9ad3b8712525fa7ab9a8fd01ce8ca68

SHA1
c72bbacedd9be4dcdd31c5bbc64d18abd5cac119

SHA256
309b80a32ed7059980141e10a76220d79164b71ce10921ee9be95ad2e52a4da2

SHA512
92f12e9d352dde9976b6f48eacff71af65b966b6462991d19af67858e8fded30c244cc2ea98250863719eecffaad5ce0f8c493369512b3d39d7c5ffc1083d3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
9KB

MD5
0fdbf69b3ff2344ca3075d108cf0552b

SHA1
68891aa43cdc163f51530330ae6bef52e0962ae4

SHA256
5f3f5d7d28091dca10bfb428aceab6448d40ff33e43a8df5b37f9b7b8eb06094

SHA512
4ccc340130a7670e48439189304c81c586d8fad276f7462d7bb3bae8f896e38224094fd8a1a5bb2d34c23a9ed575fc97db44ff476310b68d984576899dc9311b

Download Submit
memory/4624-26-0x000000000D440000-0x000000000D490000-memory.dmp

Filesize
320KB

Download