e38e0f7f03c7263afb008139825a42360a65cff527f8dff36a346d63fb7483ad

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67cbad59ec14d0a1e3d4287d53257bc0_NEIKI.pdf
Size

40KB
MD5

67cbad59ec14d0a1e3d4287d53257bc0
SHA1

6fee4da48ce9c6af40f754a97c6d946ea204a4cc
SHA256

e38e0f7f03c7263afb008139825a42360a65cff527f8dff36a346d63fb7483ad
SHA512

d0623f0111f62ff3da503e0148bf4269e06fad0aa807dd6fdf8211fe794b2e801ade82ef3532638ab0c5b17d5677e99277080a534c99acae7a894c5062c792ff
SSDEEP

768:Vziz1EG6Jg43AzeyTbSIJwTpR5PyIdSpFPRhpxCblNOfRXMruft9y6rl3wJ+3Myx:R3SFFWuFaJu/2SFYLpgD

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe
4392	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4852	4392	AcroRd32.exe	85
PID 4392 wrote to memory of 4852	4392	AcroRd32.exe	85
PID 4392 wrote to memory of 4852	4392	AcroRd32.exe	85
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 2288	4852	RdrCEF.exe	86
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87
PID 4852 wrote to memory of 1672	4852	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\67cbad59ec14d0a1e3d4287d53257bc0_NEIKI.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=713027004D4D0C55A67391038C87CDC3 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2288
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4BC346B5197068AB36EEEDC5CED0D5EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4BC346B5197068AB36EEEDC5CED0D5EC --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9275F1CD3576237A7C8EA21DAC99C5C0 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4364
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=85242D8274765F205523FB2EE01C5608 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BAC4EDD7F639EB936F00257CC76CC0E5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BAC4EDD7F639EB936F00257CC76CC0E5 --renderer-client-id=6 --mojo-platform-channel-handle=2456 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=454DB25CEDDD4FE1A2BF2C6C5AD88AA5 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
98369ff6b3830e1c57b7cdf1d1fb6d93

SHA1
1b1939076b0ddc645b02b6928cdc8c3e824932a5

SHA256
73deecf397fb2dc525eae8ca1610f61399fcf5b7f459de4507e0a575c815d1eb

SHA512
3bd2b9458df7b42e98d457d537094889ee66a572e84f79bacc0aab8623e54c33f863bf4f2c29e5a1c0cc41409e035d733fc148648526114f1777516e2f855b27

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1ecbb358c4600819a0e3f482181c0805

SHA1
11fdd8255145dc3be3c425f76f4bd05fa71ebcef

SHA256
84b32df90bf1b81c43e0ca2bb37d378c38741c5817d827da9ff569d80c11bc74

SHA512
556f4ae69fc1995a1dd1bff78ebf122589831ca082ea63dae93e2dd051e218447c26b24c45140b08e9f85a0eb7bd3af1d101a9d959bf0ea7047f77fe5e44c8d6

Download Submit