1eb9b6c9fe410660504c2509692e1f4367383c6cad6c6f069dbcc35843487231

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc8e2ecf16c2f197e539673124a0e2be.pdf
Size

44KB
MD5

dc8e2ecf16c2f197e539673124a0e2be
SHA1

0fe85e76370e44cb424214bf74b43be896ab1496
SHA256

1eb9b6c9fe410660504c2509692e1f4367383c6cad6c6f069dbcc35843487231
SHA512

9072d5abb35b21b4c748d05b74b1d69a242d34e87e8b35ad44db278bb34c7775c6079da979d7228c464c67febda900cfbd5d152500adf6d9174d7e76008227fa
SSDEEP

768:2yC2CqkBI4jnFEEnzq73DtvmBCY25f2/op0bzMvuEO1EZL+j5w:XC2C5BI4LhO7l63212/op0bzMmEGuCa

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2472	2272	AcroRd32.exe	92
PID 2272 wrote to memory of 2472	2272	AcroRd32.exe	92
PID 2272 wrote to memory of 2472	2272	AcroRd32.exe	92
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 4808	2472	RdrCEF.exe	93
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94
PID 2472 wrote to memory of 212	2472	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dc8e2ecf16c2f197e539673124a0e2be.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2A04F87BC7E220E7DC138F0C4A1C9BD0 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4808
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F86B34DAFC0A42F299F8F6D2CA52F3CC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F86B34DAFC0A42F299F8F6D2CA52F3CC --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7FC9DC00EB0DD5873C7E010ABB2ED82 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1016
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B0C99AD71994872F2B92108CF7482138 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1556
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DA76F531C9EF48E306934FEAF6327A03 --mojo-platform-channel-handle=2232 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1696
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AB5BDDCB8224EF136A0B9605929EC84B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AB5BDDCB8224EF136A0B9605929EC84B --renderer-client-id=7 --mojo-platform-channel-handle=2196 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
779f43e8984a9cc5704d461deef41a65

SHA1
d3bd00a14b43743e2d8ebf063a616954f63a816c

SHA256
be55d57e3e58f1bd905c3b1d306da9aabea48d578d2b053c341973b6390b91e6

SHA512
3fbf4a359dbc2d26505a8f59fbd1d8e855e03e3f5fa4b87a10d77b03d3a4f8053eb296e7817ad453cb1fc8fc977bbfe8db33ab4ad3d6da7096a50e5cee4a2c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
c26ed30e7d5ab440480838636efc41db

SHA1
c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591

SHA256
6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef

SHA512
96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df

Download Submit
memory/2272-26-0x0000000009F20000-0x0000000009F70000-memory.dmp

Filesize
320KB

Download