b4c3d3715f78fbed02598d490f0961fb512d7deaea514b905782a0683c96f8d8

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf
Size

419KB
MD5

84c27c930594837a40f7e080691a565d
SHA1

f04a49bde0a2f64bbb646cadee440899c7da4cb0
SHA256

30ab5c46d67f9bdb34deb1a3cfe6fc537f46772a7b7e1a7c5ec086ee13253cd5
SHA512

ef280e74f3f4aa34eeae3e4cc6869b6903701554fb5eb64ae091534b74f0bebffead324ef9eab2da2f67b04d779ee8c45eaf4b82963b7ceaf81838702479a1e7
SSDEEP

12288:RKRC4GbxtmRBI6sgDuzInXhz1cw75/hic:k8pxtgeBgDuMnXtWQhj

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4036 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

4036 AcroRd32.exe
4036 AcroRd32.exe
4036 AcroRd32.exe
4036 AcroRd32.exe

pid	process
4036	AcroRd32.exe

pid	process
4036	AcroRd32.exe
4036	AcroRd32.exe
4036	AcroRd32.exe
4036	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4036 wrote to memory of 1816	4036	AcroRd32.exe	RdrCEF.exe
PID 4036 wrote to memory of 1816	4036	AcroRd32.exe	RdrCEF.exe
PID 4036 wrote to memory of 1816	4036	AcroRd32.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 448	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe
PID 1816 wrote to memory of 3516	1816	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Paddle, Blanks and Spacers\Tech Specs\A3_Rev00B-4.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7A3DC474FD5E8270E4891F53D5C6EC9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4764568E2684CDF5C32654926058E706 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4764568E2684CDF5C32654926058E706 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3516

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=73015A914F25768A5E24BDB965CE52D2 --mojo-platform-channel-handle=2176 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=36CA14ADFD66CFE54DD0623261C6749E --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0BDEEA5A4BCA2439F893D3A7B275312D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0BDEEA5A4BCA2439F893D3A7B275312D --renderer-client-id=6 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB4457B2B255933DFCC64EF39650C8D0 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
8501e5493694e77790d00bd7e51d0137

SHA1
5d4bb8fbb713e4c617ed76a302f844ba3eff36b7

SHA256
11af5716ef804b50308ed545d6bba8d840f7f78ca3a2cb51888aec44e94240d6

SHA512
5206d079ea68d6da621d9f0ec6ec8a6742b124bed13d2cfd659c62edf2ed04b916b1962dfd5afc08ca4cc6017887676cacb17b39e3941debeb503bf1cfb96c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
3a0f268d7c0b3bb98a5914bf229d2f05

SHA1
5cbbe554eee498594693ca15fa4856f387564cb3

SHA256
45fa59fe613005932e68007622782117b919d634a7b107c3a68b6a3246184c07

SHA512
b621c73db90ad85c3e70d955b31276a46f0e7da1f049189cd1d42028d8ec34024ecd19a3b780e57834daa5068298d970430c232a073e45382a874d23ee388815

Download Submit