f8ecd72d33b4c4767a71ddeffd46d04e939b4c36293577cb7535163c5c07b79a

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c61dc9943939862cae111b001772ff0_NeikiAnalytics.pdf
Size

188KB
MD5

1c61dc9943939862cae111b001772ff0
SHA1

4cc162179f58e13bb2618a9cb2cd7ee6c8f66497
SHA256

f8ecd72d33b4c4767a71ddeffd46d04e939b4c36293577cb7535163c5c07b79a
SHA512

1b5f76ac97f809ffa60390ab5d9eba58000f9ced1f5d32e56b77358f4f9b9df9864adaeee5cb1d60b9b5fec1d826841d15bfdfc9990c16f24f7f511ff6d2e795
SSDEEP

3072:a0iu6VzDLg8gvNgsKWh9HLpUdZlOomkF6imVwIhmXZ:a08lDhgvusKS99c3O4IiSkZ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4188	2092	AcroRd32.exe	87
PID 2092 wrote to memory of 4188	2092	AcroRd32.exe	87
PID 2092 wrote to memory of 4188	2092	AcroRd32.exe	87
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4356	4188	RdrCEF.exe	88
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89
PID 4188 wrote to memory of 4616	4188	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1c61dc9943939862cae111b001772ff0_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D633531703851C37E1EC2E1E5B2C26BE --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8A9167F5A94F04A3183574DED2C3EFD5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8A9167F5A94F04A3183574DED2C3EFD5 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=81FCFD3916B86D3BF1B9D36C92FE3B4D --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41D2EB8CB70F0093F1BE6B8792D7DDA9 --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1524
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8E1F684A6335890C7D12A0402DB8B928 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8E1F684A6335890C7D12A0402DB8B928 --renderer-client-id=6 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C86A422F7D7482E0FAF55E6690494CD --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3148ebf23cdf1af18be793066d4af506

SHA1
7a89e19848617a0e2e88a214fc354b981fce1b98

SHA256
ab2a8de919dc25232f6717e59a2598e0eb760dc73e22ed4ea894d883cbb09138

SHA512
1bff5c2e6382249d8870c86af8cdc576c6cf739e46550cd0e73a43ac555ec47d4edb95f344cc67b28ec62544b878ed8b7e6f21d526530f5a334d9cc7bd596079

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
dd6fad2edeb0a487a6c506498ba2126a

SHA1
831460cf0f7b8de847d256627b10fb47343b9c40

SHA256
50503de41e4fe8fad6833c9dc18350e134f27edad0ecddd235ee242bc1b8a51a

SHA512
531a89f1449fd155a89a993d21ffa0d28a77e8821d465ed842acb8e61ea6d610a755b850198a00e2f7ea23ba5448fd73b78addff96201e24b4a69c90c87c5285

Download Submit