2074498b41b215b1de53f72ed53359397c8a0e4de648a39af04d7d34ac004585

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf848cbcb773d327c2457a137737022.pdf
Size

81KB
MD5

3cf848cbcb773d327c2457a137737022
SHA1

e706c5c99902f868d348291208bd2bac94bc302f
SHA256

2074498b41b215b1de53f72ed53359397c8a0e4de648a39af04d7d34ac004585
SHA512

603c24af23455c3fec16ca94183945c6ccabd4f55f3f5a4561a6ba87cc3590ced5b074cc7a67598afc034bfa5cbb07d11d6d539674234880cf27ebc74fa5c13c
SSDEEP

1536:Q7V1n5x7Q06ny/x5EIuVsRTjCEwzdBmuErWVyqHWapOtQolL8MogOxUON:S59Q1ojPuVsRTjCEweutotQa5k

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe
3116	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4588	3116	AcroRd32.exe	90
PID 3116 wrote to memory of 4588	3116	AcroRd32.exe	90
PID 3116 wrote to memory of 4588	3116	AcroRd32.exe	90
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 1952	4588	RdrCEF.exe	91
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92
PID 4588 wrote to memory of 5040	4588	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3cf848cbcb773d327c2457a137737022.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A3B99C8BDDC3B922D1313EE4B71E68A --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1952
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=79EB608196EA8B0B145A628072682201 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=79EB608196EA8B0B145A628072682201 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=19CE6C413352EED864DE51F61C4B8F9B --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1F7C3160E9B8DCE8CBFC61F3F37B2C06 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=44F13FB0C6CE947AED9803AA2354EB63 --mojo-platform-channel-handle=2512 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=35FD674EBA553BF8D8686F4D535D49FA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=35FD674EBA553BF8D8686F4D535D49FA --renderer-client-id=7 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
18KB

MD5
d773de0e4e3fb841406d5d5ed86afad0

SHA1
a26b10a5aa1d65a2ccadc5a99fb95a37f185eb22

SHA256
deeb230220dd2cecabd8f3e32e202680da3c2e0c0138a02a0251c1f5ad0a58e2

SHA512
a336cd568318bf26c7a881f866df08a5e8b92998fcca673c8c18dc61825cbbfc32266022e23ac0fdffb732f156ace3df18f2a9b3d2f38604914a95416cc63fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
31KB

MD5
d17fc5770392b32ee33b29e0f2ef9ad6

SHA1
ac81a61ee8b6c8db4792a06e10eb029044dfb7bf

SHA256
83c61246cac69eb374bc73f13ecb5f45030881bba30d09940d7e303be987e4ae

SHA512
7a0768dee953044883944ca0afdf11dc78495a4e8cb6e2a23e11ca7a6bbad604d1ee8ca79d182e4ee9080b48a4109d6296ee1149232f95a384cc67a5e0860649

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
11KB

MD5
5d8b176d6d888abd911846a7c6ed25f6

SHA1
2699fa36c8fa2ac85e2211619f73c05e2a8cf933

SHA256
e42cc080887902f5bd1373f82fe3c4170fcab714caa0577ffe999276f968fa76

SHA512
cc19ba33446f21929fc4b3f2d8ad1fa28c311ba1c18ae1c0c737bc8637d6609e46e8097ca95ffbed6fbeebb8ac6f15dfc49871e00842f2282420c20c080bb6a7

Download Submit