90580dbb51694fda36a2a58b21ed7f3cf71f3b2cce8ab5e3e583d0c02c5a70f9

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

051ebf99ff348dc65017f874e229315e.pdf
Size

93KB
MD5

051ebf99ff348dc65017f874e229315e
SHA1

fbb23fd61ce6e5415f6ceb160297bf06989e319a
SHA256

90580dbb51694fda36a2a58b21ed7f3cf71f3b2cce8ab5e3e583d0c02c5a70f9
SHA512

0dee46ea50358fb35d3755d9c9aa958d99602c77cb38ada4c527c81d687fbbad498f551f7d3f6419fec7addc305c610e01f86697880cfa0faec175431a85a5a3
SSDEEP

1536:MHrm2NZGNJK90Nz2AFwNttM47Y87H6FPtnZpKMpqa6SWQeLiZ1CPIeCZgMQWOpON:8myGLbqu47X7HCpAasWDCRMtwrdm15

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2548	1664	AcroRd32.exe	89
PID 1664 wrote to memory of 2548	1664	AcroRd32.exe	89
PID 1664 wrote to memory of 2548	1664	AcroRd32.exe	89
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 4968	2548	RdrCEF.exe	90
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91
PID 2548 wrote to memory of 1152	2548	RdrCEF.exe	91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\051ebf99ff348dc65017f874e229315e.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6D8AFD36428B8D59D9E73A00FBCDE8F8 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4968
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A4923CEB81688EAD576FCF44834F69C2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A4923CEB81688EAD576FCF44834F69C2 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=37F85A35F2015A92AF402DADFF2DD10D --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=97C21D2044D982AAD543A62FEDAF9C69 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=967607E1CC1E54CDDBBFF79991859F55 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=967607E1CC1E54CDDBBFF79991859F55 --renderer-client-id=5 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BEEDA0A8F08C7C6CAC95E7D91DF30068 --mojo-platform-channel-handle=2776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
c1decaf7b5a7c897bed402b40907c1b1

SHA1
a5b88f5584f6a0bf1820280f534a2d6c97760f34

SHA256
fc3b4f8ade328ee2d876b7924d7a0ad9f4f219d1c9ab4be7291ffc1e46325450

SHA512
09fc052bf209993a84b5f55eb18c17c64797ea36554fada8663c7f43dfe71990cabc187c2692130ce1bed69380d8188dd78e23b671a856191fcd5f5d8503d606

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
47KB

MD5
6d7376de3a76d15979700748f4b3e6c3

SHA1
1be583ede453f90bcdc5653d83dd8761a52a599e

SHA256
1a40663db86b9e768c5daba7cb0653dc87db97de422afd634d37b32b4eb062e7

SHA512
b0c32d7d88f7ac17aab71b16c849bd035a31ea55b905dd982a9dd5b322479403c391db6f343592c58f5f93ba680b83a3c4ea1f83f01c4b794a92dd3088ebade6

Download Submit
memory/1664-27-0x000000000BCB0000-0x000000000BCD1000-memory.dmp

Filesize
132KB

Download