2fef0b3014e0e983fb461fcf56d3f7172e10a6170b65d7ed1cd1e3b51290d062

Resubmissions

27/02/2024, 16:40

240227-t6pvdseb83 1

27/02/2024, 16:39

240227-t6aepsed8s 1

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hil 2024 Financial Plans.pdf
Size

45KB
MD5

9af19598f0f20b0e807beb37d560bc28
SHA1

1be8e292735439fe67d622fd22bb9be8b6e6d422
SHA256

2fef0b3014e0e983fb461fcf56d3f7172e10a6170b65d7ed1cd1e3b51290d062
SHA512

d9cca9f7c8007183091efef1336f1c07504b8873553c183ead3244e66214b780a79a5ecccf6a94bf58b90feee31aa92eab6ab6fb91fcc0e36f1bbdc9c3a1e418
SSDEEP

768:TG/Ao2pRYMXb9+pU8Q/jco8Hfla52cp9mgLy8rCC+4X7QUecZ:TEAorR+b/jH8dyD7GC+4X7QGZ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
564	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe
564	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4900	564	AcroRd32.exe	92
PID 564 wrote to memory of 4900	564	AcroRd32.exe	92
PID 564 wrote to memory of 4900	564	AcroRd32.exe	92
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 2008	4900	RdrCEF.exe	93
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94
PID 4900 wrote to memory of 5004	4900	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hil 2024 Financial Plans.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=66A288E5E04D5EF828C99675491BC6A7 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2008
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1B242AEF4A7F909B911E77EF35F75F87 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1B242AEF4A7F909B911E77EF35F75F87 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1A560438A5FD7C816FCFCE6DF2014AC --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2788
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=413A632719FCAB98FC47F2E72E1FC8DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=413A632719FCAB98FC47F2E72E1FC8DD --renderer-client-id=5 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16994A322C860299ED0DB863E933C31A --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BF2D8500239A409C76FCB321A3A8502F --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5f839f0015b33498b5a1b99676930c38

SHA1
cc5c3b827fd94a84d3a1b15b52533f6a4cbc72cb

SHA256
2a46d92c79eddc9e65177ba6e5b9e5ab5a81f2cb36e11cea64da420f13b26ac2

SHA512
a1e8c37ea7c41cf68349646306c9b93e5f0f23164d616fe0476d9f2b4768bb9d597048377551f4fd8ff64d2989c50f1b0dc3ddcfb94683c631f6639c99b84d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7134d6a96320eaa1d8abf1772e22bd66

SHA1
cefc8e6d2f94ccb1c5bb20ac09cc53f6251d86e4

SHA256
55c426c50bc48ac94d3083e312fa2b02329b52206a6db0d2c2b6078484856298

SHA512
34f40b2ba53a0d45341690dfd2a3d66a3c45804530df93ab772ce8e53ea87bf1504899156a7691ccd38e924c3ecb5d180ad4784ebf319cfe9416315a287e9564

Download Submit