b7f918eff6dc166c1bc50a6576b832dbc4210aa16f246b33036c02f73108878a

General

Target

Maryamcl.pdf
Size

33KB
MD5

64b40196c197ef19c2504624ce99f309
SHA1

034f9afed45495cb0ba470af819bd5d6ed00f9da
SHA256

b7f918eff6dc166c1bc50a6576b832dbc4210aa16f246b33036c02f73108878a
SHA512

ed6928007774fb9cbe3c21af895c39773353e4214f5276f20b25c0a46483f747b239f2ed6603e1348200935ca1989f385f10f83af0002a118bc0053962419394
SSDEEP

768:f3NeB7mfFZVPfWkOQoN+r30VllEozzLKx1vlO8EMIc2BlzRT2:5ZpWrkL0Vl6Gz2jlyHc2rdT2

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3248 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3248 AcroRd32.exe
3248 AcroRd32.exe
3248 AcroRd32.exe
3248 AcroRd32.exe

pid	process
3248	AcroRd32.exe

pid	process
3248	AcroRd32.exe
3248	AcroRd32.exe
3248	AcroRd32.exe
3248	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3248 wrote to memory of 4756	3248	AcroRd32.exe	RdrCEF.exe
PID 3248 wrote to memory of 4756	3248	AcroRd32.exe	RdrCEF.exe
PID 3248 wrote to memory of 4756	3248	AcroRd32.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 3180	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe
PID 4756 wrote to memory of 1012	4756	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Maryamcl.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=046A4F59B9388BA2CB21C8DC31E6A1CB --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8825DC31608D41AE53BDCE93F124AD73 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8825DC31608D41AE53BDCE93F124AD73 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9CDDFCC4B43B05275D23F890E84F563 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4936

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=42C24BF321E0C9006ACF65B46E8B1518 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=42C24BF321E0C9006ACF65B46E8B1518 --renderer-client-id=5 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2552

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A6BB8F0B8A580AD98AED275E956D16FE --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2096

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1A98FF371CF1251F8A265A0B7BB2F12E --mojo-platform-channel-handle=2820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
ce5dc9d635291739b8b2cb9db886939d

SHA1
87dfe1a831b289bbae92430aa2438eed9aadbe45

SHA256
8ff6b1fdb09d067e0bc1315b7668c2affc64bda6fdb0082ac36321892795b0cd

SHA512
f35c56e2029017bbc04f41f2f7701149e1eed6e976716b4500713d4d23d2ae9ee910e12a69681d454e65d047ddb5e128d40c099bf434d7f391bd3596a61ffbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
65884c2e5825324407ba52040204e5ac

SHA1
01ae1c6acc955020104ee8eaf3de9ca45474a557

SHA256
2f8142bd41db792e29ec6e3f5d5f87b0f3de75563f62b3f1f3463237c9d60b8e

SHA512
092d20b25b47596c9e3bc75a74f374098123da59957023735004d24c3c00234886f3c88d5b1f974cf9fd603bee23b2a70279de00352214c2274325cb03f2b554

Download Submit
memory/3248-29-0x0000000009C00000-0x0000000009C50000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads