9dd94db760b23e5c824577652a412dcbe91d113a5fd8988cf185b675092d1cd8

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a457cc4f58dc53d3d3406f9f49801492.pdf
Size

74KB
MD5

a457cc4f58dc53d3d3406f9f49801492
SHA1

4fe953cf9cefd1dcf77a0de260779e27c27d78d7
SHA256

9dd94db760b23e5c824577652a412dcbe91d113a5fd8988cf185b675092d1cd8
SHA512

0026608ade631b998eff65ec4e78250e84e9d9909cf269a12d5107cc935ab11a20375e8909af6c81c3d2c4cdb6cbee0f399b4f06fe51d5b88c70d4d29fa4495a
SSDEEP

1536:+a7dd0Bb7CrlAqkcAqx4KLiOkwPPi5xEL4S3pUeWepOWjW267I6z7CUC:f+KeBqx4KTkwy5xy/pUjW2s

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1348	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe
1348	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2872	1348	AcroRd32.exe	91
PID 1348 wrote to memory of 2872	1348	AcroRd32.exe	91
PID 1348 wrote to memory of 2872	1348	AcroRd32.exe	91
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 3724	2872	RdrCEF.exe	93
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92
PID 2872 wrote to memory of 4232	2872	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a457cc4f58dc53d3d3406f9f49801492.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0C32003A6BAE096C4347A7D82568E3B5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0C32003A6BAE096C4347A7D82568E3B5 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E5665B51258E433B841B56CE83B507D --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3724
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A82B805123D5012DAC96744D8BC3D08 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0477A5AD4150B3E6631FF3E7E079060C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0477A5AD4150B3E6631FF3E7E079060C --renderer-client-id=6 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4BB808EA2E62F6B67BE137CD268A5713 --mojo-platform-channel-handle=2388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=560EE83AFDE53D069D6502172664A592 --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
cc870f1bf49c8ace800d22f3fcc7e055

SHA1
52a3ef6288710637f41410f0620f331383b3476c

SHA256
69d2ae4c34b71c50f66112082c2b79a2ad0d37e7b3a3f85c9b1f6650c532cc5c

SHA512
730271f5b261bc34ff99843789b86ee776ff6c0ca3dbed292fc14096a8c3d0b0e7539ae55f8454f74d2ab5990ec14072c4f8a81a1cd2ea71fffd4afc97b58271

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit