447a62c7e29e2da85884b6e4aea80aca2cc5ba86694733ca397a2c8ba0f8e197

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3 Person Flight Itinerary.pdf
Size

175KB
MD5

423d33b0463acea9c92b3d92add08d54
SHA1

5764acc21ef559e009a63a9b623caa4f1c8ddd52
SHA256

180bca1f964b60ceb034bf933c9696aa6ccff3779accd5f8d24fd3efe15d8c0f
SHA512

5702b88c2ad3194e1acae15bc8a6161da769de1b81f300033e9596fcecd47861675f72e329c02175adb26e62a7d99b43f673ea3429f56dd4df5d7f6e925b0135
SSDEEP

3072:XtfTjguemghjjE2uvXqbvf1aS2h/WlhEL9XDlOuEeMQN6g2w8k3ixEq1RRHJloh2:Xtf3gu2hfE2ufQf1h2h/WlG+L/QY2y62

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3612	2084	AcroRd32.exe	91
PID 2084 wrote to memory of 3612	2084	AcroRd32.exe	91
PID 2084 wrote to memory of 3612	2084	AcroRd32.exe	91
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 652	3612	RdrCEF.exe	93
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94
PID 3612 wrote to memory of 4804	3612	RdrCEF.exe	94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3 Person Flight Itinerary.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=795353E3931D8662E43A7F90605076E4 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:652
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1CB24DF7EADE85508FE00F1EB96A0003 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1CB24DF7EADE85508FE00F1EB96A0003 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=29D63AF3164B6A2F60D2D112E1E7BE57 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=29D63AF3164B6A2F60D2D112E1E7BE57 --renderer-client-id=4 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A398A6061BE59DDD26F4510CD8B31EFE --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4808
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EB0E26897AD7BD7172FD5619833C3814 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3316
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6C13A11C2D5AEECE1A3E666FB42498E --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
699f5aa4b5561a2e30c7d4fe26247048

SHA1
781b35b62220410a3f817a43b40426095bd6243a

SHA256
67c8fdd5cc762f5f1f286de43d19e0508ea467cfd5e69ec1873031c4b9e11229

SHA512
6857136d0d2ca772cb5d0bf2062a14ed142da6ec5d86e3507352adee9701f70c9bef5c35448eadf2411192633551de96afaa77fa002bf08a4e1e811887d08ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
2fc364ace4faa2dc68a359d8871bbf68

SHA1
fed962f73840d1b29ef9a323da87fe2c5192b89c

SHA256
1df42163a6f906cfdf3fd7c43d79fab0ff44081ae9869df3e0b84406ff45a75e

SHA512
129bae4d628bf83351baebe724219ea921c25e52985517c012348752bb5ccbca8c7fe18f2a4a2e1aef5a67996c1014cf34488a98c48e2e6c60d45d5b7805e6f5

Download Submit