76222c45918f263e25a7d7dd9632ecf1e0836128d511c050265c2b75c1001900

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2643e2a981f6273c81720e9d39397e63.pdf
Size

33KB
MD5

2643e2a981f6273c81720e9d39397e63
SHA1

d608d1cd39c148129ec92f1226ba224f6a5745c9
SHA256

76222c45918f263e25a7d7dd9632ecf1e0836128d511c050265c2b75c1001900
SHA512

16dbaa763b1c13a2dcb96cf726eb613167289eb53227cb2d229ef7f893f3d9afcf4956a34fbd29a626b506f0828edbc49e6dfabbfcac8826cf1e58f9de456ce5
SSDEEP

768:wBVJlqFQmOWEhJXzVij7lXTgJH6ww647JTUHlUvY:SVJlhmOWOx5H6wwPVXvY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe
3660	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1832	3660	AcroRd32.exe	92
PID 3660 wrote to memory of 1832	3660	AcroRd32.exe	92
PID 3660 wrote to memory of 1832	3660	AcroRd32.exe	92
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4220	1832	RdrCEF.exe	94
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93
PID 1832 wrote to memory of 4536	1832	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2643e2a981f6273c81720e9d39397e63.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA5544630CD1E0ECB3DF9D9CDB5B4FD2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4536
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D0692DA068346190C6898B79FE0C1656 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D0692DA068346190C6898B79FE0C1656 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=85A70544805347432FACE1C7B07ED341 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=85A70544805347432FACE1C7B07ED341 --renderer-client-id=5 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A650F9E855094064BEB9E9ABB697146 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD8A610929CB45521B3B9905F7C95043 --mojo-platform-channel-handle=2608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1048
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40DDD84C1F9607A2C752D21E75779C5B --mojo-platform-channel-handle=2588 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
429f141d6d27c321b3cf0b00c50c1f07

SHA1
367f1176324e465f920fe6daf7fa248c820920a9

SHA256
9e745bca4bbbdf1cf0dcb7a5cec2c0c71af8be884692cc26433cba980ac44462

SHA512
dcf4eb2cf559594796ab79a2fe86d18266e9e4548e6e57ac1094988841b97073be119d044773d88bfdf55cca487113e01ef2a057396c51a0d90b70738f054ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
6KB

MD5
4568aa7d09fdd5f13a655b9ed119b188

SHA1
2ef857a304e72fcae8a7e342d0a46a5d7e754ef6

SHA256
4b99aba399fdc4cbe5932ef4fc7cd4b2ddd436214b307a018ed19f8f4a86b225

SHA512
d3ade8e60e7efbce6b87af7c2e2087cf8269a11ddb737e6274de47244ab32825ca14ce53a73bc856a32393ab8d64cbd0cedf669d8591a4dea5699ab078c646aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit