2191303b8ec467194ac940137b6a0315c0d9561eb3be1d94631f19026b60b904

General

Target

Catalogo ICA Suministros Industriales 2024.pdf
Size

1.6MB
MD5

ae1b4b4838ef88f0b73dbaa980509e6f
SHA1

a723cff3dc4d7714bed50756c7563a62362e9068
SHA256

2191303b8ec467194ac940137b6a0315c0d9561eb3be1d94631f19026b60b904
SHA512

673c7139891e3466452934756607f151ba498d11fb13cb9d74b4af1498025a95ffe72f6036f16a4d0a2ba1892e5d0d75d09d316ef421b901367cd1f4299167d7
SSDEEP

24576:COMn4ueQkzH6LmNvu/PhJxtQZIOwSvbWWguzM5QRVkY3KLxwc8DVJwsB:PMYQkWLEm3JWZpwSvbd9M5QRi4rhB

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3052 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3052 AcroRd32.exe
3052 AcroRd32.exe
3052 AcroRd32.exe
3052 AcroRd32.exe

pid	process
3052	AcroRd32.exe

pid	process
3052	AcroRd32.exe
3052	AcroRd32.exe
3052	AcroRd32.exe
3052	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3052 wrote to memory of 860	3052	AcroRd32.exe	RdrCEF.exe
PID 3052 wrote to memory of 860	3052	AcroRd32.exe	RdrCEF.exe
PID 3052 wrote to memory of 860	3052	AcroRd32.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 920	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe
PID 860 wrote to memory of 624	860	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Catalogo ICA Suministros Industriales 2024.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7807CF54132FE0BD2AA283B2E43386F2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:920
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3539F9626B397D213D96493F880FDFDD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3539F9626B397D213D96493F880FDFDD --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0914E0E7DCBE49DED078363DE7C5404B --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3A3D79243C55F5006C4A1283A7AF867A --mojo-platform-channel-handle=1932 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1528
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=14BEDCC30B85A5DB27918F7D06B8F1A9 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4012
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7945C69F4DB5A7050DDE5F7A70112CAA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7945C69F4DB5A7050DDE5F7A70112CAA --renderer-client-id=7 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads