937448e00e9b69c5cf10368cd88a656a8aca7a1baa526581bc7b366978fa2d9b

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac135ecfa46f2ba21c967efd48b48f38.pdf
Size

69KB
MD5

ac135ecfa46f2ba21c967efd48b48f38
SHA1

e4aa97206bd3567d76ea8f9c75917fc5da6ab807
SHA256

937448e00e9b69c5cf10368cd88a656a8aca7a1baa526581bc7b366978fa2d9b
SHA512

9fc7d6904b90313af91432ee52bfffa76d2513b7092d7fa9fb78d986dd895292715622460918653c5fe90cd9366357f4925c0aa501a3608ef9a7214722ec1cdf
SSDEEP

1536:iEY16ibjV7VaV+eQXXMoAIxn0cEbDJWYpO24EM67juILWGHKpfy0Rwc:NOjV0oHX8oAI0cEXg24z0juINKpfVN

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3372	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe
3372	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 740	3372	AcroRd32.exe	91
PID 3372 wrote to memory of 740	3372	AcroRd32.exe	91
PID 3372 wrote to memory of 740	3372	AcroRd32.exe	91
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 4724	740	RdrCEF.exe	92
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93
PID 740 wrote to memory of 3516	740	RdrCEF.exe	93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ac135ecfa46f2ba21c967efd48b48f38.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B5096E9AE185E55E085CF4F1CEC2452 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4724
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=679C7E3F65E1A4AD3E0168B3C8305513 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=679C7E3F65E1A4AD3E0168B3C8305513 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3516
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=397510E63D7FF90DD9D870ADF055948B --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C4FD6337059394043933462E7F6087DD --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3300
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C30497793C56A4E36BD9103D66514263 --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4976
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6B108220AEFC36F9888D7A5B66FAA7EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6B108220AEFC36F9888D7A5B66FAA7EC --renderer-client-id=7 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5edc76e631a536f6f65093ce6eab1b47

SHA1
304556099092af028b4796ac642d39d370c18ed7

SHA256
6b76296956414c641c7c77e7e50df1ee6abf1a6636c4e6ab23e61a65a477e87a

SHA512
42e9449d01e76892b1ce6958fceaaa31cdc69dbeaba13008ce2726a69f1bfbfbb71b0ef12f68cc16df91c0bfc9ea21f6a02f0a6a0520f4449dd3168977ce14ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
18KB

MD5
949d9a4dcdb05f3eec51cd9b50c3fa87

SHA1
376eca963929aed0147c851303bab4125a3203b3

SHA256
c93c0dac4770a91b1afba392faf4e51ea88da1ebdc386b243bf455cd17663df4

SHA512
11cb72a4fbc8a5c5027e9cddb540c9d77ef77df9e5771c149070960e8a8906373d6059f89158d7eb118ab6dcfb77bae65766b41d835345cd839b0501e5daee97

Download Submit