821ae40c81f3842ef7bf378776139fff074daf49cf409e265d85e7e3d998a27d

Analysis

max time kernel
158s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e11d65cca7a7dfcd50de6f42dc322f5.pdf
Size

120KB
MD5

0e11d65cca7a7dfcd50de6f42dc322f5
SHA1

ccefee8b0fbdc15833b3a8047933ede99f7c3e24
SHA256

821ae40c81f3842ef7bf378776139fff074daf49cf409e265d85e7e3d998a27d
SHA512

4c01f1e55f5b6f9822420a9af118fad65ce4d9f47ff72b97da64fd565d56128daab98f61c23fd6d251b571084a5a610acb2aa8c1c6f1aa1bb4bb647fea950a4a
SSDEEP

3072:i7wTKSKBiKCHRSMCWbTsJAMW7usiSo+ZdrTCZY:8wGdCUWbyWaJirrT

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4796	2840	AcroRd32.exe	96
PID 2840 wrote to memory of 4796	2840	AcroRd32.exe	96
PID 2840 wrote to memory of 4796	2840	AcroRd32.exe	96
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 5028	4796	RdrCEF.exe	98
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97
PID 4796 wrote to memory of 4988	4796	RdrCEF.exe	97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e11d65cca7a7dfcd50de6f42dc322f5.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FE9E975AC723966B28B6C1C9506EC824 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FE9E975AC723966B28B6C1C9506EC824 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5590C7E33585F0F5F468E43140F565FC --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=776C6C248FD293E88EF185AE2E51A588 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=776C6C248FD293E88EF185AE2E51A588 --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ECA88D1A5537A8CF38E76D94787BD4A7 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=231A81C61C95F10437D17513E26630A5 --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AB73A67BFC8F610951CC2F7BEC5A497E --mojo-platform-channel-handle=2644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
53KB

MD5
809366b7790b5f6f7969e9b253067e63

SHA1
752bb2f476d8647a47f7dd109345cda7dd469ef9

SHA256
2b0d6994cf583908ac430762f192f1d840adbca78b498471492d68fbe6fcb2ed

SHA512
0410ab9d46f84fd515681ee25b242c12da9499f7fddda07f18a82aa6d78be3832e7f23720af817402aa12ef6bd364d9973cf2cb0bdf305549b6b5e96a73cfd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
55KB

MD5
1ad424ee56c65611cb8a4afa82815e76

SHA1
6321ea88cd2852e14874af6b55be569161b40358

SHA256
ddbcdf319cef53acd27ecdabfdadde3c08b275b0ccb919bd6c14b436f181b9c7

SHA512
8b459c2ef919a893cf4df72fae529084fbb43fee2eb70b7451854b7a545dcdbaac549eca91176bf0e3460fb74ea81deda048651f579b850ef279d155912aab1b

Download Submit