3770773e44c6c1d9479e4e0817e616c379f0a17880012ac9d60a0e7b04206c36

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8ae04f9b8746fad853268a599336fd.pdf
Size

43KB
MD5

4c8ae04f9b8746fad853268a599336fd
SHA1

f10756e5a0c01bda7fe334e203cddb90d8e29c3d
SHA256

3770773e44c6c1d9479e4e0817e616c379f0a17880012ac9d60a0e7b04206c36
SHA512

1d233afabb6ce7ce4286618114d217122693c04ead32bcbec973cd26a7c0db548d119a48c05f40ed4e8126a80f3f31b8047015082eac06bccc7d57c1584b50a4
SSDEEP

768:9AZqGDUmKvudCle36u0rQlh5Jgdd+fcsHtt7SRP/nIwkpJE:9AwGQZudzOQlHJgMcsHtt7s/nIFpJE

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1492	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe
1492	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3604	1492	AcroRd32.exe	94
PID 1492 wrote to memory of 3604	1492	AcroRd32.exe	94
PID 1492 wrote to memory of 3604	1492	AcroRd32.exe	94
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 1576	3604	RdrCEF.exe	99
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98
PID 3604 wrote to memory of 2496	3604	RdrCEF.exe	98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4c8ae04f9b8746fad853268a599336fd.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C1C36EB134572BC627D78D70C759F1D2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C1C36EB134572BC627D78D70C759F1D2 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0DD0FCC18FCD5889DF6871A816C6FDE4 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1576
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9ECBA010D277FA20BA5A306002BCC069 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4956
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33C92A05870B1859611839D7AD30D38A --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3160
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=80E566A7C963AA6192BB7C051CCBEA15 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=80E566A7C963AA6192BB7C051CCBEA15 --renderer-client-id=7 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=07368E95221B606AF46E8A69A73E9DDC --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
13KB

MD5
c643f53253215f25797fb764e9605d43

SHA1
f5a541d2b4c5739073faba7917bfa593597e3a59

SHA256
c71f86668fee35f63f5eb05041948ebfdf77f8090139e3c279d477ee3702b5b1

SHA512
88787de5234b5fc040bd514cf7e81c848ae62aa611631e5cb68f634378bb8b8bd7edcb412877e2d02f135e512523988a009c85698a9b573d21cbf9e0a86ad8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
49KB

MD5
6f4c31c47734036c486c933197b1739c

SHA1
494c8fcaa4836e7b051d6ac4ce81d0bd2b8c1a0a

SHA256
cba3932cb92f8f5c315f8b2cd3a157e10b7fcd150a449a2962a76ecf28c4da58

SHA512
cef3ca97e118c93ba308afd9ba7062db6ce196768f4461fec70f7963eb3d03ac29c62ab351ac90059b4676ec36062c76ba77d02d8bce55b3585d6fcffb4aec9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
1KB

MD5
d0df5f9974138501424cb06472477adf

SHA1
9d143e2c9c48327c6fa0b4f2fb65be982037db51

SHA256
6c3615c908cb98afc062e70b7f985bf7b667fd8540a25824aa07a14b6b6a05d6

SHA512
9a7d8b47a8311e00ba206fee9bf0d42991a0caaf43492ea067bb6c9eb333a3231a35bae1efcd95add82d6dbfcfef5e10d42c084b9e73c5fdd7eadf8131324617

Download Submit