3f0e07fc6345cc179b7571de8b9fb2bfee2f9bef92a4ec224b4e034cd49e697f

General

Target

InstallerAPI.pdf
Size

102.1MB
MD5

db0521bd7e4b9fc803f9a900212eea02
SHA1

6c86b49b4c1e3ebcecd5376166bfe3bda6a141fa
SHA256

e95ce4146e3ffe7d5fde36340c01889f7634d6f91b92fbae1606bef9cb4a7cfb
SHA512

22d219dac43bd3200e666ef7e554584b0fd43c57c0a6dd7888dc80f71a9b5e73ba48400607205a4f1680af0ccaa197fdb1add05fc7f698e9246fe00a6a49080f
SSDEEP

3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWpg:M

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

320 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

320 AcroRd32.exe
320 AcroRd32.exe
320 AcroRd32.exe
320 AcroRd32.exe

pid	process
320	AcroRd32.exe

pid	process
320	AcroRd32.exe
320	AcroRd32.exe
320	AcroRd32.exe
320	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 320 wrote to memory of 5068	320	AcroRd32.exe	RdrCEF.exe
PID 320 wrote to memory of 5068	320	AcroRd32.exe	RdrCEF.exe
PID 320 wrote to memory of 5068	320	AcroRd32.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3656	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe
PID 5068 wrote to memory of 3940	5068	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\InstallerAPI.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=76CC9B9D93595FE48DBBB1EF064B6797 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=76CC9B9D93595FE48DBBB1EF064B6797 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3656

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C66FB4CD321466EB06A4D85C6FD9CA6 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=572DE3BD0B3420BA9CBCAE21B6BEBD8C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=572DE3BD0B3420BA9CBCAE21B6BEBD8C --renderer-client-id=4 --mojo-platform-channel-handle=2180 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3568

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C6E38631447279871B3E3299FF46D545 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3220

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1B0EC346C2948AEABE745F09FB0C7CF3 --mojo-platform-channel-handle=2104 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2192

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=07CD794697DAB1B8344F10E73D0532DF --mojo-platform-channel-handle=2112 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4dd69f225e0cf2fb09e5ff1669fbee1b

SHA1
df84e1c1e829b8cdf58520fbc5475389d538cdac

SHA256
b590f82f7a7029d2440265ee4ba63e795c3736147b3b512f11a52bf7de4b9227

SHA512
416b105beacc43c05f16339b03dd273608eddc934da4a620cfb99a64dacf9786690dd19ab219867bbef3d6a34909d20f39b82b358dd158fc971a65b51784cfbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
053bb0444035fd56d17e5b726d200eb4

SHA1
4fdcfa6327d2a4889ea0d9d177b4c1a477bed8b2

SHA256
c492c458768fcff12432658c67a2da936862f1e6fe7b29a0101f764b42670b1d

SHA512
236f1bb84a45a0a58d46e323727f884bab52c910b10498a6d66d478d3f1e9d4495e44e0209c0be4accce9253a1e1dcac829ed1dc18030448f0b4b64c06b2ec34

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads