367547f151358c3ff872bda0017ed0871842b946c7b61da5e4d91f48176a617d

Analysis

max time kernel
173s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2024, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INFECTED.pdf
Size 6KB
Sample240317-vxp98sbf7s
SHA256 367547f151358c3ff872bda0017ed0871842b946c7b61da5e4d91f48176a617d
MD5 c37ae9efc4eefcf1fe9cefa69a9e51f4
SHA1 1d917b8bb8794064d5d8fbf917bd7342dd84a343
SHA512 6195e28d733fe1ed391b2dda328a6f2dae8a5ccd7cf9808d4418fc6adc3912e4256ebc795a8ed82f5ad2f54415363d6de703dc445185f759533b1066810f1b99
SSDEEP 192:ZCt+rgfWPZ8kZNyI2q284BrCPjKa1hu/7ko5U19ceD:ZCtCgmW+4cCrCma1huTfW19ceD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4220	AcroRd32.exe
4220	AcroRd32.exe
4220	AcroRd32.exe
4220	AcroRd32.exe
4220	AcroRd32.exe
4220	AcroRd32.exe
4220	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 2312	4220	AcroRd32.exe	91
PID 4220 wrote to memory of 2312	4220	AcroRd32.exe	91
PID 4220 wrote to memory of 2312	4220	AcroRd32.exe	91
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 4424	2312	RdrCEF.exe	93
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94
PID 2312 wrote to memory of 2736	2312	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\INFECTED.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8597BE8508628F5CB9C83C9495F476E7 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F1BEC4CF124D93DBB7CF162722306D61 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F1BEC4CF124D93DBB7CF162722306D61 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6927CC85A7768C925AF1CACECAFA0055 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6927CC85A7768C925AF1CACECAFA0055 --renderer-client-id=4 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4FFFA9D691644086B466F65B206F1F08 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AECBF0DEE428E32CFDEADC7D38B49E27 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4828
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FEEE27DD7450DF37A006ADBCB6C50489 --mojo-platform-channel-handle=2608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 893a592c57b8b173edca253dca91c1e1250ceb535581ae7b7e8347c7232ef391
MD5 1f4a1a9ef2af7108781e19f3386f85aa
SHA1 e935b13d24fbcf7b42e0e62e5624e934ffa0897e
SHA512 688ef1a79762b0b9a1d774f7a3b9e4144ab369f431542cc8ac8916d27548f2d438c13610eebf3da765a9e765d950580ae9038d1b76f20803b583d86c250e0146
SSDEEP 384:yeFdThPqtELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:xq+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download