cdac3717e15507ded659a1c4f2aeca8319dc7d7b47d2a5c83330cba75726c302

General

Target

win7_64bit_big.pdf
Size

2.7MB
MD5

c8bdc1044384d9900da05f070185d5fe
SHA1

ce3155923f3385059f176825314872f04d0a6bc2
SHA256

cdac3717e15507ded659a1c4f2aeca8319dc7d7b47d2a5c83330cba75726c302
SHA512

5baecced1d0b8f53ddfe0cc71f7f774363015550fe96a8f5c3d20bf7f34b64a12e9d797032d5d0378d31142cdfa34cf3bb63470ebd53b8b3528582ab3bd3dd7f
SSDEEP

768:xNRuQ/LFK42bZIEF3NRuQ/LFK42bZIEFG:U

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3060 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

3060 AcroRd32.exe
3060 AcroRd32.exe
3060 AcroRd32.exe
3060 AcroRd32.exe
3060 AcroRd32.exe
3060 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3060 wrote to memory of 764	3060	AcroRd32.exe	RdrCEF.exe
PID 3060 wrote to memory of 764	3060	AcroRd32.exe	RdrCEF.exe
PID 3060 wrote to memory of 764	3060	AcroRd32.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 656	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe
PID 764 wrote to memory of 952	764	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\win7_64bit_big.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2CA254F49FF0D066B5C859910B3C0FFC --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:656

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=89CFE629E38C8BF56A3A2AECE959BE5E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=89CFE629E38C8BF56A3A2AECE959BE5E --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
3⤵
PID:952

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4817416F9AA089B65C27684B7BD664BF --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1588

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5847AFCBE125A68327131C0868C71C6 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:396

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40102A0E25F86E4948029FC0C51F1980 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2216

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=12D12479DD4BA09259E33DF29B70C6C4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=12D12479DD4BA09259E33DF29B70C6C4 --renderer-client-id=8 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job /prefetch:1
3⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Filesize
12KB

MD5
e3124d36f3cabd60666e18e9b2ce4533

SHA1
85ea3c60ba4cad1d9478f09e9f2d10fae1461bbf

SHA256
6ad4725cc5fcc2bcc863ccd54b53c3f0f5680582ce13672262bc4e1621253089

SHA512
c5502ce29e98904e94cfb8085e41d24aebd165971f89fea1c83b42a476925bdcb78e7dcb9080dffce2e7fd430b2136b950da902a8b66c125ead93b022a66e354

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads