c2e11e7e9cfd9a29665d954b9d53fea999ef76e9cac035b0281544860e1d9fcc

General

Target

special!! (4).pdf
Size

27KB
MD5

61198f8292cb1c08687baf892ae107c7
SHA1

671e94d931a89c3d9c535fc2aaad220b2d9dc8e7
SHA256

c2e11e7e9cfd9a29665d954b9d53fea999ef76e9cac035b0281544860e1d9fcc
SHA512

98daa709f416f5e87f823a70feb372ab1ff9b267ff2ccab286c50181bef22089b8e54195ef097de6f106a8943bd767395c527f6d54f35c67427bca53bf8fec20
SSDEEP

768:7kl1WNNKQJrmTHZjku168ET9ki1/lEHbDG2KoQTN9COA/U/kqYnchhFLniTP:nwG2jQTN9nAYkhn8hFiD

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe
5360	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

5360 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

5360 AcroRd32.exe
5360 AcroRd32.exe
5360 AcroRd32.exe
5360 AcroRd32.exe
5360 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 5360 wrote to memory of 5268	5360	AcroRd32.exe	RdrCEF.exe
PID 5360 wrote to memory of 5268	5360	AcroRd32.exe	RdrCEF.exe
PID 5360 wrote to memory of 5268	5360	AcroRd32.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5916	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe
PID 5268 wrote to memory of 5320	5268	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\special!! (4).pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:5268

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4CEAD8461CB353C22608448208D0FE3A --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5916

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D58CDC7FAD3165137EE5F7D148401254 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D58CDC7FAD3165137EE5F7D148401254 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
3⤵
PID:5320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=967C74E6664668516395C2093ADA53B4 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=846C814C2CC421405B111530B4F4EB18 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8BF26F80117FEBC5A114DBAAC2330A14 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8BF26F80117FEBC5A114DBAAC2330A14 --renderer-client-id=6 --mojo-platform-channel-handle=2364 --allow-no-sandbox-job /prefetch:1
3⤵
PID:5508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=955E6922B76BDCDAFB76DD83D8090EE2 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
35c6862982e1b644502c903a7664ca1f

SHA1
4ce4d3e99590593172fa5492d6c41a2acfb377a1

SHA256
7a0e97c4b2f054ccbabdb94f71a46312fc1a54d99db1bca637e60fd9985aeaf3

SHA512
be5c205167e4ac319d6079d129b83f7d847df7282579473ef011750171572dd6128d0aafef47a88af90457f038281452e6028aa6b3d593cf288666c3ddac4d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
56973011be43fb20d80da946e7262433

SHA1
1ddeee94d13c20386c58c16bacfeaf86eb1ab415

SHA256
a167bf45855b2f14602f0b29e5be93d4995e525aa366bde20381a67d170fa6a6

SHA512
f7d32281218618c2b3f9500928fe97dfb51001684f949dd50771789d955e8c79d081bb55aaee784c7cf3dfc43d774932b9ce3cf6b549d06cc7befca8e64950e1

Download Submit
memory/5360-30-0x000000000A2D0000-0x000000000A2F1000-memory.dmp

Filesize
132KB

Download
memory/5360-29-0x000000000A2D0000-0x000000000A320000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads