48d3873a709cfb07cd8aaa61a24313018b172eebbd905a7548873645b5d31df0

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Leeb Wolfgang pdf.pdf
Size

76KB
MD5

9bdf5d7231f691464b87070f2e43c5c4
SHA1

19942d12ce81a370e531a8c815da0224e4355da0
SHA256

48d3873a709cfb07cd8aaa61a24313018b172eebbd905a7548873645b5d31df0
SHA512

92f54862b6328543a09b44d9a35aa141ccc35d40b7c15ac5687b4e818683b2b10f214529ded60ec98951c974b180a0e742ff97f2b5e1cd66719692aadea4848a
SSDEEP

1536:C5B7pFjUUb81Vsh2qJnXwI9wOPb6nj6yCTnmFBeEgED61:C77pFQQKsEgg3ybeFCSFBfgww

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3280	AcroRd32.exe
3280	AcroRd32.exe
3280	AcroRd32.exe
3280	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 884	3280	AcroRd32.exe	99
PID 3280 wrote to memory of 884	3280	AcroRd32.exe	99
PID 3280 wrote to memory of 884	3280	AcroRd32.exe	99
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 3084	884	RdrCEF.exe	100
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101
PID 884 wrote to memory of 4112	884	RdrCEF.exe	101

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Leeb Wolfgang pdf.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1EF3CF80E0064AC34E5F6E9F0D3177F1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1EF3CF80E0064AC34E5F6E9F0D3177F1 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B449BDCCDA4946DFD4AB80A477AECE08 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4112
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9BAF386F67D74C6691474B0F63AE2F41 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9BAF386F67D74C6691474B0F63AE2F41 --renderer-client-id=4 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6FA6365D10B2571D621C64C545B9F1F6 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=784F9B5234F0DC90FB9A242E9F98C231 --mojo-platform-channel-handle=2600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4280
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1DB6C9C860F0944992645B52C1983F61 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
35ef35b2e3fc2b29e15283139cfe4715

SHA1
76f4144de78775582208d9296e27321105eb63c8

SHA256
d8b434efe23d4bfb6cebdacc0d0704e25df7771b08828028bac30bde086c4acd

SHA512
e1e630f73e79b212ebbc10d4892196d001be9154d5519b91c7f9a2335851cc8834874f3865e0baeeeae1a220106ca3159053819aea095181ac20c6be45a361d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
fdd23088ce425e289a23e95997cf8f94

SHA1
a97cab660562d53c8f3bece8878bc9112ac65883

SHA256
7b12ac1408b98c80178fe132905a325f96c2aadfc2649c0e41a0389ffe468d0d

SHA512
07520ab22a52e5b5b39805f9544d003f446e5df970459eeba5599c42fc67ac5bd068f99138a34271fe4570183dbb37bc89fc1158ded064bade4a33ee8fcc38bb

Download Submit
memory/3280-29-0x0000000009930000-0x0000000009951000-memory.dmp

Filesize
132KB

Download