05a027e9c29d4a67a3faf251ffbddb0e106912529a01d8edb726d691e46a8a49

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0f836ca1227e07981f0363a593524b8.pdf
Size

81KB
MD5

a0f836ca1227e07981f0363a593524b8
SHA1

54a9f950c7a120ed6cbd74285bde0b2a08140225
SHA256

05a027e9c29d4a67a3faf251ffbddb0e106912529a01d8edb726d691e46a8a49
SHA512

c2d9c4900235f5217e7a95c250f3d2e2a365b1ebc41eec3ed0041c60d63d55f02e502a92d1394538d6ab14c6b767b343563dc413ce5161a84a2e52f8b875cabe
SSDEEP

1536:6vegCAv/PqOOJwOjbF3BtCwEVWvLd/KhcZJRuWWspORSLHXq+:6PCQCOfOjbF2gd/mcZJEJRSLXr

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5008	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe
5008	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4364	5008	AcroRd32.exe	86
PID 5008 wrote to memory of 4364	5008	AcroRd32.exe	86
PID 5008 wrote to memory of 4364	5008	AcroRd32.exe	86
PID 5008 wrote to memory of 4852	5008	AcroRd32.exe	87
PID 5008 wrote to memory of 4852	5008	AcroRd32.exe	87
PID 5008 wrote to memory of 4852	5008	AcroRd32.exe	87
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 3184	4364	RdrCEF.exe	88
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89
PID 4364 wrote to memory of 2800	4364	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a0f836ca1227e07981f0363a593524b8.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0830B3ED4393E4083B57762CF4A2A517 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1C1A7A63047E369F5423F50369AEF460 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1C1A7A63047E369F5423F50369AEF460 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A84AE7EAAFA57FD643B939C6C507E07C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A84AE7EAAFA57FD643B939C6C507E07C --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=476BAB6CF240E38658168542DEEA096E --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4160
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2757F69549E790C6FC1A1BA15B376B96 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2268
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A2DA65267E4F998DEEC8DBB541CB81B --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1648
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f29b3ca956373e60d8d1e2a1281c64f2

SHA1
b77064f04dfd5694afef332a6833cae08052ac0e

SHA256
505186f3fef10fbeeeeb0ce88d2a80e0bf6999b79c9704b6840b3a86c84b1474

SHA512
bcbcf2cecf6046d7554f97150f969a2189b75105c2c1f980f57a02d74bf7e1c77be2f72af1b4b460dfb2ed8b01091779633bacdd0dda24502207e9190b6843af

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
25KB

MD5
4c286902b0f7000992a2b116a0be7c73

SHA1
50540841ed49d68c2a7af751981f0a4db171b7a5

SHA256
d90f6d2147283d5a8cad3e54d6815ddf857c4d6e2baaf4ffd95a86167cae21e2

SHA512
d608f4f13afb3bacacf7f80aa1ebbe0372be7ee49e72fa1a86923f0d99f74c57de408e1955c4862d82aeb08f8061e5930204d8f76a6b84a84d8d796fab989435

Download Submit