47a2b8172e8e9f54dee4df46363f655754e42e44abf48d6e7bc062407cd914f2

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8cdded2036eecf24c1a6cb3b8303baa.pdf
Size

93KB
MD5

c8cdded2036eecf24c1a6cb3b8303baa
SHA1

3fe76d1cd99dbbf3c349173fc69d7765a32d8601
SHA256

47a2b8172e8e9f54dee4df46363f655754e42e44abf48d6e7bc062407cd914f2
SHA512

71021a612450ef5bc8d20cdee168828197a0216a12cca83c6e1a6b0f2e8bd090d70083aa6092c359ba3c0d1df11170361a628ddad45418045d2bdcec5c40553c
SSDEEP

1536:j23UxBxJmC+biARRjK5ppSIdUYU0mKJ5/lecPO4/WXdIWW8W6pOu2zplCfMk:S3UhmC2RG/pDUYU0dLlW46di1u23CP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4356	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4356	AcroRd32.exe
4356	AcroRd32.exe
4356	AcroRd32.exe
4356	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 940	4356	AcroRd32.exe	96
PID 4356 wrote to memory of 940	4356	AcroRd32.exe	96
PID 4356 wrote to memory of 940	4356	AcroRd32.exe	96
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 3636	940	RdrCEF.exe	97
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98
PID 940 wrote to memory of 2244	940	RdrCEF.exe	98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8cdded2036eecf24c1a6cb3b8303baa.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D5DFDEED38485D2A4663F0E7DC52A42C --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3636
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=308F55251C22A5AF34631DCC245BF3A4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=308F55251C22A5AF34631DCC245BF3A4 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DA828272489C2739C51664FD2C221451 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DA828272489C2739C51664FD2C221451 --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=185CD03F13C7B536FEE22D32D3EA92B6 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA3E44B27207B47FBC5F84D4D43B1030 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9784024415B18F20EF621A7569EBD625 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5540e804863d0c77426c7915bf852e24

SHA1
4f77e5432822ed09b7259bd7687e4448b2a59735

SHA256
f5001c24f2c6d687ae3aaf5327a979e83a97a72eeb88f630d939d5a5b789a052

SHA512
682e198902dd0bb66fbe93fc3fb16efd01c79f7f99bb0510b78f86bd2efb357f3f464e3078c755400628061d96a5fd47f0c5924b10c21b62a48aad3d6fd6c1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
241d0099778613245854fa8b8566b903

SHA1
931d28b7333316b2de53daa6a325a948d11a3822

SHA256
6e4802a56464d6e18291c4409191c66df5e33e1545748b24bafc96e0f9bf90a4

SHA512
b26c9d29357346f5b5e67063629740e14f84ba881c75539f6afade18e04e3dc718eefed71169b4e17246a5b184f3f0e63117dcb3f7e5c69cc12dab5dd8038dc8

Download Submit
memory/4356-30-0x000000000BDC0000-0x000000000BDE1000-memory.dmp

Filesize
132KB

Download