1da9b787afe57eae267a052eaea088349f57e5d4b23e76faf063c6caeb7c1ede

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37fef5c37cc7e7c17f6dc943064ff923.pdf
Size

77KB
MD5

37fef5c37cc7e7c17f6dc943064ff923
SHA1

c72dbe10bfe207464e860500d7ff6b0c956b4d26
SHA256

1da9b787afe57eae267a052eaea088349f57e5d4b23e76faf063c6caeb7c1ede
SHA512

5c6cb64842764000306ea78021d9d01e09c8c1c38ed3991dfb439c9bc870290213be751861a888ec2b14faed517a0d6c34764fcf6a6b5cbebabaf803a4f3d60b
SSDEEP

1536:6YLE8BJi3ZpCoPw1Yq+23O7y7okMdxGMLyWNb5/30U68x8W8pO+2ip:9yPwF+SXMjGQb9sU1x3+X

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2796	1740	AcroRd32.exe	91
PID 1740 wrote to memory of 2796	1740	AcroRd32.exe	91
PID 1740 wrote to memory of 2796	1740	AcroRd32.exe	91
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4552	2796	RdrCEF.exe	92
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93
PID 2796 wrote to memory of 4388	2796	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\37fef5c37cc7e7c17f6dc943064ff923.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=28A484B0F510DC7ACC4C56832C8297E5 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DB8679816E47F73064D2ED9EF1CE577F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DB8679816E47F73064D2ED9EF1CE577F --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=703E3160F115D700BFCDFF62973FCF2B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=703E3160F115D700BFCDFF62973FCF2B --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06571466932B1C9C6ECE16A20CCDD2E2 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:428
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFA8D23B116BEAB4A762E975DB709B57 --mojo-platform-channel-handle=2804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F88C4F5431B784AD13AFAF609C8449A --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8667d7c2b456639a82c4150fc8ea76e3

SHA1
828ee9abd49961d4b52361691b3ffdf089df7ab6

SHA256
b3b41a8548699c0c7584678d3e7baa4ab4ae6a65f12265199d9c266b526fcf53

SHA512
9d3a9efa1970e14b49b21ac52cceeadf804649db8f61fac325dc6df8d1b5b6688c318f6648d44fe8f72c2541cb911666c6e72e2ed9f5523442d7873ce4e22ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
10KB

MD5
3c27ffaf0da8b2384e85deb28acfcb1e

SHA1
e37e4ed362653e6ca4b5d08b69925a85d66d0bb4

SHA256
5e270459255470774889d3aa8928b9ad29b0b1c9e1b7740326924ceacda4c70d

SHA512
5381689e145e44353ffa2ed75f0623fe61116cf0e931e9f2a54bee561d3aff81b4b484875d2e77f3887a8631db85761cf5e840bb3bee9072e707c74fb27d2827

Download Submit